cve-2019-11707

SpiderMonkey - CVE-2019-11707 बग: https://bugs.chromium.org/p/project-zero/issues/detail?id=1820 स्क्रीनशॉट फ़ाइलें exploit.js - वास्तविक शोषण, saelo के util.js और Int64.js द्वारा प्रस्तुत। stager.js - स्थिरांक बनाने के लिए उपयोग किया जाता है, saelo के util.js और Int64.js द्वारा प्रस्तुत।...

CVE-2026-2763-POC

Уязвимость Уязвимость возникает из-за реализации синтаксиса for-in. Область действия цикла for-in представлена парой байткодов: JSOP::Iter и JSOP::EndIter. root@kitploit: CASEIter MOZASSERTREGS.stackDepth = 1; HandleValue val = REGS.stackHandleAt-1; JSObject iter = ValueToIteratorcx, val; // 1 if...

CVE-2024-8381

CVE-2024-8381 ثغرة خلط الأنواع Type Confusion في مفسّر SpiderMonkey. يحتوي هذا المستودع على تحليلات بصيغتي Markdown وعرض تقديمي، بما في ذلك السبب الجذري وإثبات المفهوم PoC والاستغلال. لسوء الحظ، ونظرًا لطبيعة هذه الثغرة، لا يكون الاستغلال ممكنًا إلا عند تعطيل ASLR. الشرائح: Slides.pdf التحليل:...

CVE-2024-29943

CVE-2024-29943 一个 Pwn2Own SpiderMonkey JIT 漏洞：从整数范围不一致到边界检查消除再到 RCE。 基于 https://github.com/bjrjk/CVE-2024-29943 在 Windows 上复现 CVE-2024-29943 修改说明 原漏洞利用代码是针对 Linux 编写的，因此我尝试在 Windows 上复现： 更新了 Windows 下的弹出计算器的 shellcode，并调整了一些堆风水参数。（我尚未完全理解 Windows 堆的工作原理，因此只是调整了一些数值直到稳定。） 使用 Uint8Array 代替 Array...

CVE-2026-8389

CVE-2026-8389 이 취약점은 Pwn2Own 2026 Berlin에서 사용할 예정이었으나, 버전 150.0.3에서 패치되었습니다. SpiderMonkey BaselineJIT의 즉시 오프스레드 베이스라인 컴파일 경로에서 pcOffset 비트 필드 잘림이 발생하여, 예외 언와인딩 중 범위 내에 있지만 잘못된 바이트코드 pc가 생성되고 결과적으로 타입 혼동이 발생합니다. 요약 RetAddrEntry는 바이트코드 오프셋 pcOffset을 28비트 비트 필드로 저장합니다. 같은 헤더에 정의된...

CVE-2024-29943

CVE-2024-29943 Un bug JIT di SpiderMonkey scoperto al Pwn2Own: dall'inconsistenza dell'intervallo degli interi all'eliminazione del controllo dei limiti, quindi RCE. Questo repository contiene PoC, Exploit e slide di analisi per CVE-2024-29943. Demo Demo.mp4 Slide Slides.pdf Informazioni per la...

CVE-2026-15718-who-put-ptrs-in-my-wasm

CVE-2026-15718 — quem colocou ponteiros no meu wasm Cadeia de exploits de prova de conceito para CVE-2026-15718 , uma má compilação por falta de sync no compilador baseline do WebAssembly do SpiderMonkey da Mozilla componente "JavaScript: WebAssembly". Um único array.fill de zero iterações gera u...

CVE-2026-2796-escape-wasm-by-using-wasm

CVE-2026-2796 — SpiderMonkey WebAssembly सैंडबॉक्स एस्केप CVE-2026-2796 के लिए प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट चेन, जो Mozilla SpiderMonkey के WebAssembly इम्पोर्ट ऑप्टिमाइज़ेशन "JavaScript: WebAssembly" कंपोनेंट में JIT गलत-संकलन / टाइप-कन्फ्यूज़न है। एक क्राफ्टेड wasm मॉड्यूल संपूर्ण होस्ट प्रोसे...

MiracleLinux 8 : thunderbird-102.13.0-2.el8.ML.1 (AXSA:2023-6238:20)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6238:20 advisory. Mozilla: Use-after-free in WebRTC certificate generation CVE-2023-37201 Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey...

MiracleLinux 9 : thunderbird-102.8.0-2.el9.ML.1 (AXSA:2023-5140:11)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-5140:11 advisory. Mozilla: Arbitrary memory write via PKCS 12 in NSS CVE-2023-0767 Mozilla: Content security policy leak in violation reports using iframes...

MiracleLinux 9 : thunderbird-102.13.0-2.el9.ML.1 (AXSA:2023-6243:21)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6243:21 advisory. Mozilla: Use-after-free in WebRTC certificate generation CVE-2023-37201 Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey...

MiracleLinux 7 : firefox-102.13.0-2.0.1.el7.AXS7 (AXSA:2023-6240:25)

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6240:25 advisory. Mozilla: Use-after-free in WebRTC certificate generation CVE-2023-37201 Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey...

CVE-2025-14331

Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6...

CVE-2025-14322

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6...

CVE-2025-14330

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6...

CVE-2025-14321

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6...

CVE-2025-13023

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145...

CVE-2025-13019

Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

CVE-2025-13017

Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

CVE-2025-13027

Memory safety bugs present in Firefox 144 and Thunderbird 144. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 145 and Thunderbird 145...