CVE-2019-8601

利用 CVE-2019-8601 这是一个针对 WebKit 漏洞的利用代码，该漏洞最初由 Fluoroacetate 在温哥华的 pwn2own 比赛中发现。虽然这个漏洞不是我发现的，但我编写这个利用代码是为了练习我的漏洞利用开发技能。该漏洞的原始分析文章 在此，来自 Zero Day Initiative。虽然这篇分析文章写得很好，并且对我理解漏洞非常有帮助，但它是从验证漏洞的角度出发的。我发现，在从头开始编写利用代码时，一些关键细节是缺失的，我希望填补 ZDI 分析文章中遗漏的一些空白，并获得如何从头设计一个复杂利用代码的实用技能。 利用步骤 以下步骤概述了在...

DarkSword_analysis

DarkSwordanalysis DarkSword iOS WebKit 利用链的静态分析 — 投递、部署与 CVE 分解 CVE-2025-31277, CVE-2025-43529 我是一名大一信息系统专业的学生，在构建逆向工程和恶意软件分析技能的过程中，正在研究这条利用链。随着学习新概念和深入分析代码，我会更新这份分析报告。 来源 htimesnine/DarkSword-RCE Lookout Threat Intelligence iVerify — Inside DarkSword Google GTIG — Proliferation of DarkSword...

SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2026:4020-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4020-1 advisory. - CVE-2026-28984,CVE-2026-43804,CVE-2026-64713,CVE-2026-64719,CVE-2026-64728,...

Bagagwa-Exploit-PS5

Bagagwa exploit, PS5 12.40 -- work in progress Thanks to Clau...

ps5-12.40-jailbreak

PS5 12.40 native exploit, work in progress This is the workin...

Astra Linux – Vulnerability in WebKit2GTK

A correctness issue in JIT was addressed through improved checks. This issue has been fixed in tvOS 16.1, iOS 15.7.1, iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1, and iPadOS 16. Processing maliciously crafted web content may disclose internal states of the app...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been addressed through improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1, and iPadOS 16. Processing maliciously crafted web content may disclose sensitive user information...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been resolved through improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2, iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, and watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption...

Astra Linux – Vulnerability in WebKit2GTK

A memory corruption issue has been resolved through improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, tvOS 15, iOS 15, and iPadOS 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution...

Astra Linux – Vulnerability in WebKit2GTK

A “use-after-free” issue has been addressed through improved memory management. This issue is fixed in Safari 18.4, iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, and watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari cras...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been resolved through improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6, iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, and watchOS 7.5. A malicious application may be able to leak sensitive user information...

Astra Linux – Vulnerability in WebKit2GTK

There was an issue with URL handling that caused spoofing. This issue has been addressed through improved input validation. This issue is fixed in iOS 16.4 and iPadOS 16.4. Visiting a malicious website may result in address bar spoofing...

Astra Linux – Vulnerability in WebKit2GTK

This issue was resolved by removing the origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4, and iPadOS 16.4; iOS 15.7.4 and iPadOS 15.7.4; tvOS 16.4; and watchOS 9.4. A website may be able to track sensitive user information...

Astra Linux – Vulnerability in WebKit2GTK

There is a code execution vulnerability in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A specially crafted web page may lead to a use after free issue...

Astra Linux – Vulnerability in WebKit2GTK

A memory management issue related to “use after free” operations has been addressed through improved memory management practices. This issue is fixed in Safari 16.4.1, iOS 15.7.5, and iPadOS 15.7.5; iOS 16.4.1, and iPadOS 16.4.1; as well as macOS Ventura 13.3.1. Processing maliciously crafted web...

Astra Linux – Vulnerability in WebKit2GTK

Description: A cross-origin issue with iframe elements was addressed by improving the tracking of security origins. This issue is fixed in tvOS 14.6, iOS 14.6, iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, and watchOS 7.5. Processing maliciously crafted web content may lead to cross-site...

Astra Linux – Vulnerability in WebKit2GTK

A vulnerability related to out-of-bounds reads has been addressed through improved input validation. This issue is fixed in iOS 14.8, iPadOS 14.8, tvOS 15, watchOS 8, iOS 15, and iPadOS 15. Processing a maliciously crafted audio file may lead to the disclosure of restricted memory...

Astra Linux – Vulnerability in WebKit2GTK

The issue was addressed through improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, and watchOS 9.6. Processing web content may lead to arbitrary code execution...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved user interface. This issue has been fixed in Safari 18 and macOS Sequoia 15. Visiting a malicious website may result in address bar spoofing...

Astra Linux – Vulnerability in WebKit2GTK

A “use-after-free” issue has been addressed through improved memory management. This issue is fixed in watchOS 10, iOS 17, iPadOS 17, tvOS 17, macOS Sonoma 14, and Safari 17. Processing web content may lead to arbitrary code execution...