WebKit WebCore::RenderObject::previousSibling Use-After-Free

WebKit: use-after-free in WebCore::RenderObject::previousSibling CVE-2017-13798 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= .class9 column-span:...

WebKit WebCore::FormSubmission::create Use-After-Free

WebKit: use-after-free in WebCore::FormSubmission::create CVE-2017-13791 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function jsfuzzer...

WebKit: use-after-free in WebCore::AXObjectCache::performDeferredCacheUpdate(CVE-2017-13795)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector simply opening the...

WebKit: out-of-bounds read in WebCore::SimpleLineLayout::RunResolver::runForPoint(CVE-2017-13784)

There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==30436==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000560c48 at pc...

WebKit: use-after-free in WebCore::Style::TreeResolver::styleForElement(CVE-2017-13802)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==30588==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000077ec8 at pc...

WebKit: use-after-free in WebCore::FormSubmission::create(CVE-2017-13791)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==934==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000b9810 at pc 0x000114b6f4...

WebKit: use-after-free in WebCore::InputType::element(CVE-2017-13792)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==29682==ERROR: AddressSanitizer: heap-use-after-free on address 0x60800005dca8 at pc...

WebKit: use-after-free in WebCore::DocumentLoader::frameLoader(CVE-2017-13794)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==689==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110000889c8 at pc 0x000114c94a...

WebKit: out-of-bounds read in WebCore::SVGPatternElement::collectPatternAttributes(CVE-2017-13783)

There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==30453==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200007e474 at pc...

WebKit: use-after-free in WebCore::RenderObject::previousSibling(CVE-2017-13798)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==732==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000089218 at pc 0x00010e8a4e...

WebKit: out-of-bounds read in WebCore::RenderText::localCaretRect(CVE-2017-13785)

There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==30388==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000f5de6 at pc...

WebKit: use-after-free in WebCore::TreeScope::documentScope(CVE-2017-13796)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==29647==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e00005d0d8 at pc...

WebKit: use-after-free in WebCore::RenderObject::previousSibling(CVE-2017-13798)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==732==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000089218 at pc 0x00010e8a4e...

WebKit: use-after-free in WebCore::PositionIterator::decrement(CVE-2017-13797)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. ASan log: ================================================================= ==29700==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000149b24 at pc...

WebKit - WebCore::AXObjectCache::performDeferredCacheUpdate Use-After-Free

WebKit - WebCore::AXObjectCache::performDeferredCacheUpdate Use-After-Free / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1347 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility...

WebKit - WebCore::FormSubmission::create Use-After-Free

WebKit - WebCore::FormSubmission::create Use-After-Free function jsfuzzer textarea1.setRangeText"foo"; textarea2.autofocus = true; textarea1.name = "foo"; form.insertBeforetextarea2, form.firstChild; form.submit; function eventhandler2 forvar i=0;i a b !--...

WebKit - WebCore::DocumentLoader::frameLoader Use-After-Free

WebKit - WebCore::DocumentLoader::frameLoader Use-After-Free function go iframe.name = "foo"; var form = document.createElement"form"; iframe.src = "data:text/html,foo"; form.submit; window.onbeforeunload = f; function f document.head.appendChilddel; ::get...

WebKit - WebCore::DocumentLoader::frameLoader Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function go iframe.name = "foo"; var form = document.createElement"form"; iframe.src = "data:text/html,foo"; form.submit; window.onbeforeunload = f; function f document.head.appendChilddel; ::get...

WebKit - WebCore::RenderText::localCaretRect Out-of-Bounds Read Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1348 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit WebCore::RenderText::localCaretRect Out-Of-Bounds Read

WebKit: out-of-bounds read in WebCore::RenderText::localCaretRect CVE-2017-13785 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= max-height: 0;...