16465 matches found
WebKit Safari iOS iTunes Privilege Escalation
The vulnerability of the WebKit component in the Safari browser, the iOS operating system, and the multimedia player iTunes arises from an operation that goes beyond the buffer limits in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged conte...
WebKit Safari iOS iTunes Privilege Escalation
The vulnerability of the WebKit component in the Safari browser, the iOS operating system, and the multimedia player iTunes arises from an operation that goes beyond the buffer limits in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged conte...
WebKit Safari iOS iTunes Privilege Escalation
The vulnerability of the WebKit component in the Safari browser, the iOS operating system, and the multimedia player iTunes arises from an operation that goes beyond the buffer limits in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged conte...
WebKit Safari iOS iTunes Privilege Escalation
The vulnerability of the WebKit component in the Safari browser, the iOS operating system, and the multimedia player iTunes arises from an operation that goes beyond the buffer limits in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged conte...
WebKit Safari iOS iTunes Privilege Escalation
The vulnerability of the WebKit component in the Safari browser, the iOS operating system, and the multimedia player iTunes arises from an operation that goes beyond the buffer limits in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged conte...
iTunes < 12.6.2 Multiple Vulnerabilities
Binary data 700168.prm...
Safari < 10.1.2 Multiple Vulnerabilities
Binary data 700166.prm...
WebKit: heap-buffer-overflow in WebCore::RenderSearchField::addSearchResult(CVE-2017-7049)
There is a heap buffer overflow in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function go i.value = "1"; i.type = "search"; f.submit;...
WebKit: JSC: Stack-Use-After-Free in ObjectPatternNode::appendEntry
Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNode pattern, ExpressionNode defaultValue, BindingType bindingType mtargetPatterns.appendEntry Identifier, propertyExpression, false, pattern,...
WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive(CVE-2017-7037)
JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of getPrototype to get an object's prototype. So JSDOMWindow::getPrototype which checks the Same Origin Policy is not called. The PoC shows to call a setter of another origin's object. PoC 1 -...
WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform(CVE-2017-7056)
Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit storeArgumentCountIncludingThisargumentCountIncludingThis; // store arguments ... node-remove;...
WebKit: use-after-free in WebCore::InputType::element(CVE-2017-7042)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= var runcount = 0; function go runcount++; ifruncount 2 return; i.type = "foo"; i.select; i.type =...
WebKit: JSC: Incorrect scope register handling in DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry)
Here's a snippet of DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry. void flushInlineStackEntry inlineStackEntry ... if mgraph.needsScopeRegister flushmcodeBlock-scopeRegister; mcodeBlock| instead of |mcodeBlock|. But it doesn't. As a result, the scope register of...
WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy(CVE-2017-7064)
WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy Here's a snippet of JSArray::appendMemcpy. bool JSArray::appendMemcpyExecState exec, VM& vm, unsigned startIndex, JSC::JSArray otherArray auto scope = DECLARETHROWSCOPEvm; if !canFastCopyvm, otherArray return false; IndexingType type =...
WebKit: use-after-free in WebCore::Node::nextSibling(CVE-2017-7039)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar i=0;i...
WebKit: use-after-free in WebCore::getCachedWrapper(CVE-2017-7040)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar i=0;i...
WebKit: use-after-free in WebCore::RenderObject with accessibility enabled(CVE-2017-7046)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector simply opening the...
WebKit: use-after-free in WebCore::Node::getFlag(CVE-2017-7041)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC note that you might need to refresh a page a couple of times to trigger the bug: ================================================================= -webkit-flow-into:...
WebKit: use-after-free in WebCore::AccessibilityNodeObject::textUnderElement(CVE-2017-7048)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector simply opening the...
WebKit: use-after-free in WebCore::AccessibilityRenderObject::handleAriaExpandedChanged(CVE-2017-7043)
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector simply opening the...