Microsoft Chakra Typed Array JIT Optimization Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Chakra. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the generation ...

WebKit JSC - JIT Optimization Check Failed in IntegerCheckCombiningPhase::handleBlock

WebKit JSC - JIT Optimization Check Failed in IntegerCheckCombiningPhase::handleBlock range.mmaxBound range.mmaxBound = data.maddend; range.mmaxOrigin = node-origin.semantic; else if data.maddend origin.semantic; ... The problem is that the check |data.maddend range.mmaxBound| is a signed...

WebKit JSC - JIT Optimization Check Failed in IntegerCheckCombiningPhase::handleBlock

range.mmaxBound range.mmaxBound = data.maddend; range.mmaxOrigin = node-origin.semantic; else if data.maddend origin.semantic; ... The problem is that the check |data.maddend range.mmaxBound| is a signed comparison. PoC: -- function f let arr = new Uint32Array10; for let i = 0; i 0x100000; i++...

WebKit JSC Jit Optimization Check Failure

WebKit: JSC: JIT optimization check failed in IntegerCheckCombiningPhase::handleBlock CVE-2017-2547 When compiling Javascript code into machine code, bound checks for all accesses to a typed array are also inserted. These bound checks are re-optimized and the unnecessary checks are removed, which...

Microsoft Edge Charkra Incorrect Jit Optimization Exploit

Exploit for windows platform in category dos / poc Microsoft Edge: Chakra incorrect jit optimization with TypedArray setter. CVE-2017-0071 PoC: "use strict"; function funca, b, c a0 = 1.2; b0 = c; a0 = ; ----------------------- 2 return 0; ; a0.toString; main; In the above code, Chakra assumes th...

Microsoft Edge Charkra Incorrect Jit Optimization

Microsoft Edge: Chakra incorrect jit optimization with TypedArray setter. CVE-2017-0071 PoC: "use strict"; function funca, b, c a0 = 1.2; b0 = c; a0 = ; ----------------------- 2 return 0; ; a0.toString; main; In the above code, Chakra assumes that the type of |a| will be still a native float arr...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2680-1)

A flaw was discovered in the user space memory copying for the pipe iovecs in the Linux kernel. An unprivileged local user could exploit this flaw to cause a denial of service system crash or potentially escalate their privileges. CVE-2015-1805 A flaw was discovered in the kvm kernel virtual...

Ubuntu: Security Advisory (USN-2678-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2679-1: Linux kernel (OMAP4) vulnerabilities

A flaw was discovered in the user space memory copying for the pipe iovecs in the Linux kernel. An unprivileged local user could exploit this flaw to cause a denial of service system crash or potentially escalate their privileges. CVE-2015-1805 Daniel Borkmann reported a kernel crash in the Linux...

Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2664-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2664-1 advisory. A race condition was discovered in the Linux kernel's filehandle size verification. A local user could exploit this flaw to read potentially sensative...

Ubuntu: Security Advisory (USN-2666-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...