14132 matches found
Multiple Apple Products WebKit Memory Corruption Vulnerability (CNVD-2018-25675)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that comes with Mac OS X and iOS; WebKit is an open source web browser engine jointly developed by KDE, Apple, and Google. WebKit is a set of open source Web browser engine jointly developed by KDE, Apple Apple...
WebKit JSC JIT - ByteCodeParser::handleIntrinsicCall Type Confusion Exploit
WebKit JIT - ByteCodeParser::handleIntrinsicCall Type Confusion Exploit / case ArrayPushIntrinsic: ... if staticcastargumentCountIncludingThis = MINSPARSEARRAYINDEX return false; ArrayMode arrayMode = getArrayModemcurrentInstructionOPCODELENGTHopcall - 2.u.arrayProfile, Array::Write; ... This cod...
WebKit JSC JIT - JSPropertyNameEnumerator Type Confusion Exploit
WebKit JSC JIT - JSPropertyNameEnumerator Type Confusion Exploit / When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the information of the input object to the for-in loop. Inside the loop, the structure ID of the "this" object of ever...
WebKit JIT - 'ByteCodeParser::handleIntrinsicCall' Type Confusion
/ case ArrayPushIntrinsic: ... if staticcastargumentCountIncludingThis = MINSPARSEARRAYINDEX return false; ArrayMode arrayMode = getArrayModemcurrentInstructionOPCODELENGTHopcall - 2.u.arrayProfile, Array::Write; ... This code always assumes that the current instruction is an opcall instruction...
WebKit JSC JIT - 'JSPropertyNameEnumerator' Type Confusion
/ When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the information of the input object to the for-in loop. Inside the loop, the structure ID of the "this" object of every getbyid expression taking the loop variable as the index is...
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the 'ForInContext' Object
/ This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding ForInContext object, but it doesn't. As a result, an arbitrary object can be passed as the property variable to the...
Multiple Apple Products WebKit Memory Corruption Vulnerability (CNVD-2018-25684)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that comes with Mac OS X and iOS; WebKit is an open source web browser engine jointly developed by KDE, Apple, and Google. WebKit is a set of open source Web browser engine jointly developed by KDE, Apple Apple...
Multiple Apple Products WebKit Memory Corruption Vulnerability (CNVD-2018-25679)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that comes with Mac OS X and iOS; WebKit is an open source web browser engine jointly developed by KDE, Apple, and Google. WebKit is a set of open source Web browser engine jointly developed by KDE, Apple Apple...
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the ForInContext Object
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the ForInContext Object / This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding...
WebKit JSC JIT - JSPropertyNameEnumerator Type Confusion
WebKit JSC JIT - JSPropertyNameEnumerator Type Confusion / When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the information of the input object to the for-in loop. Inside the loop, the structure ID of the "this" object of every getbyi...
WebKit JIT - ByteCodeParser::handleIntrinsicCall Type Confusion
WebKit JIT - ByteCodeParser::handleIntrinsicCall Type Confusion / case ArrayPushIntrinsic: ... if staticcastargumentCountIncludingThis = MINSPARSEARRAYINDEX return false; ArrayMode arrayMode = getArrayModemcurrentInstructionOPCODELENGTHopcall - 2.u.arrayProfile, Array::Write; ... This code always...
Multiple Apple Products WebKit Memory Corruption Vulnerability (CNVD-2018-25685)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that comes with Mac OS X and iOS; WebKit is an open source web browser engine jointly developed by KDE, Apple, and Google. WebKit is a set of open source Web browser engine jointly developed by KDE, Apple Apple...
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Exploit
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the ForInContext Object / This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding...
[SECURITY] Fedora 29 Update: chromium-70.0.3538.77-4.fc29
Chromium is an open-source web browser, powered by WebKit Blink...
WebKit memory corruption vulnerability in multiple Apple products (CNVD-2018-25673)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that comes with Mac OS X and iOS; WebKit is an open source web browser engine jointly developed by KDE, Apple, and Google. WebKit is a set of open source Web browser engine jointly developed by KDE, Apple Apple...
Multiple Apple Products WebKit Denial of Service Vulnerability (CNVD-2018-26497)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that comes with Mac OS X and iOS; WebKit is an open source web browser engine jointly developed by KDE, Apple, and Google. WebKit is a set of open source Web browser engine jointly developed by KDE, Apple Apple...
Multiple Apple Products WebKit Memory Corruption Vulnerability (CNVD-2018-26502)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that comes with Mac OS X and iOS; WebKit is an open source web browser engine jointly developed by KDE, Apple, and Google. WebKit is a set of open source Web browser engine jointly developed by KDE, Apple Apple...
CVE-2018-4372
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8...
WebKit memory corruption vulnerability in multiple Apple products (CNVD-2018-25683)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that comes with Mac OS X and iOS; WebKit is an open source web browser engine jointly developed by KDE, Apple, and Google. WebKit is a set of open source Web browser engine jointly developed by KDE, Apple Apple...
Apple iOS WebKit Address Bar Spoofing Vulnerability
Apple iOS is the United States Apple Apple company for mobile devices developed by a set of operating systems. WebKit is KDE, Apple Apple, Google Google and other companies jointly developed a set of open source Web browser engine, currently used by Apple Safari and Google Chrome and other...