Apple iOS < 10.3.3 Multiple Vulnerabilities

Binary data 700167.prm...

WebKit WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free

WebKit: use-after-free in WebCore::AccessibilityNodeObject::textUnderElement CVE-2017-7048 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug...

WebKit JSC arrayProtoFuncSplice Uninitiailzed Memory Reference Vulnerability

WebKit JSC suffers from an uninitialized memory reference in arrayProtoFuncSplice. WebKit: JSC: uninitialized memory reference in arrayProtoFuncSplice Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result =...

WebKit JSC - arrayProtoFuncSplice Uninitialized Memory Reference

WebKit JSC - arrayProtoFuncSplice Uninitialized Memory Reference lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if UNLIKELY!result throwOutOfMemoryErrorexec, scope; return encodedJSValue; // The result can have an ArrayStorage indexing type...

WebKit JSC - JSObject::putInlineSlow JSValue::putToPrimitive Universal Cross-Site Scripting

WebKit JSC - JSObject::putInlineSlow JSValue::putToPrimitive Universal Cross-Site Scripting let f = document.body.appendChilddocument.createElement'iframe'; let loc = f.contentWindow.location; f.onload = = let a = 1.2; a.proto.proto = f.contentWindow; a'test' = toString: function...

WebKit JSC - DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry) Incorrect Scope Register Handling

WebKit JSC - DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry Incorrect Scope Register Handling scopeRegister; mcodeBlock| instead of |mcodeBlock|. But it doesn't. As a result, the scope register of |inlineStackEntry-mcodeBlock| may have an incorrect offset in the stack layout phase...

WebKit JSC - JSArray::appendMemcpy Uninitialized Memory Copy

WebKit JSC - JSArray::appendMemcpy Uninitialized Memory Copy indexingType; if type == ArrayWithUndecided && copyType != NonArray if copyType == ArrayWithInt32 convertUndecidedToInt32vm; else if copyType == ArrayWithDouble convertUndecidedToDoublevm; else if copyType == ArrayWithContiguous...

WebKit JSC JSArray::appendMemcpy Uninitialized Memory Copy Vulnerability

WebKit suffers from a JSC JSArray::appendMemcpy uninitialized memory copy vulnerability. WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy CVE-2017-7064 WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy Here's a snippet of JSArray::appendMemcpy. bool...

WebKit JSC Incorrect Scope Register Handling Vulnerability

WebKit suffers from a JSC incorrect scope register handling in DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry. WebKit: JSC: Incorrect scope register handling in DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry CVE-2017-7018 Here's a snippet of...

WebKit JSC ObjectPatternNode::appendEntry Use-After-Free Vulnerability

WebKit JSC suffers from an ObjectPatternNode::appendEntry stack use-after-free. WebKit: JSC: Stack-Use-After-Free in ObjectPatternNode::appendEntry Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNo...

WebKit WebCore::InputType::element Use-After-Free

WebKit: use-after-free in WebCore::InputType::element CVE-2017-7042 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= var runcount = 0; function go...

WebKit JSC JSObject::putInlineSlow / JSValue::putToPrimitive XSS

WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive CVE-2017-7037 JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of getPrototype to get an object's prototype. So JSDOMWindow::getPrototype which checks the Same Origin Policy is not called...

WebKit JSC Incorrect Scope Register Handling

WebKit: JSC: Incorrect scope register handling in DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry CVE-2017-7018 Here's a snippet of DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry. void flushInlineStackEntry inlineStackEntry ... if mgraph.needsScopeRegister...

WebKit WebCore::Node::getFlag Use-After-Free

WebKit: use-after-free in WebCore::Node::getFlag CVE-2017-7041 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC note that you might need to refresh a page a couple of times to trigger the bug:...

WebKit WebCore::Node::nextSibling Use-After-Free

WebKit: use-after-free in WebCore::Node::nextSibling CVE-2017-7039 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar...

WebKit WebCore::getCachedWrapper Use-After-Free

WebKit: use-after-free in WebCore::getCachedWrapper CVE-2017-7040 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar...

WebKit JSC arrayProtoFuncSplice Uninitiailzed Memory Reference

WebKit: JSC: uninitialized memory reference in arrayProtoFuncSplice Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result = JSArray::tryCreateForInitializationPrivatevm,...

WebKit JSC JSArray::appendMemcpy Uninitialized Memory Copy

WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy CVE-2017-7064 WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy Here's a snippet of JSArray::appendMemcpy. bool JSArray::appendMemcpyExecState exec, VM& vm, unsigned startIndex, JSC::JSArray otherArray auto scope =...

WebKit WebCore::RenderObject Use-After-Free

WebKit: use-after-free in WebCore::RenderObject with accessibility enabled CVE-2017-7046 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. O...

WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling

WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform CVE-2017-7056 Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit...