WebKit - WebCore::AXObjectCache::performDeferredCacheUpdate Use-After-Free Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1347 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be...

WebKit WebCore::TreeScope::documentScope Use-After-Free

WebKit: use-after-free in WebCore::TreeScope::documentScope CVE-2017-13796 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a;...

WebKit WebCore::DocumentLoader::frameLoader Use-After-Free

WebKit: use-after-free in WebCore::DocumentLoader::frameLoader CVE-2017-13794 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function go iframe.name...

WebKit - WebCore::RenderObject::previousSibling Use-After-Free

WebKit - WebCore::RenderObject::previousSibling Use-After-Free .class9 column-span: all; function f document.execCommand"indent", false; var var00031 = window.getSelection.setBaseAndExtentsum,16,null,6; f; !-- ================================================================= ASan log:...

WebKit - 'WebCore::AXObjectCache::performDeferredCacheUpdate' Use-After-Free

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1347 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac...

WebKit - 'WebCore::SimpleLineLayout::RunResolver::runForPoint' Out-of-Bounds Read

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1349 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= / border-bottom: green...

WebKit - 'WebCore::Style::TreeResolver::styleForElement' Use-After-Free

function eventhandler1 try txt.appendChildkg; catche function eventhandler2 try anim.appendChildkg; catche function eventhandler3 try table.scrollIntoViewtrue; catche a !-- ================================================================= ASan log:...

WebKit - WebCore::RenderText::localCaretRect Out-of-Bounds Read

WebKit - WebCore::RenderText::localCaretRect Out-of-Bounds Read / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1348 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit - WebCore::SVGPatternElement::collectPatternAttributes Out-of-Bounds Read

WebKit - WebCore::SVGPatternElement::collectPatternAttributes Out-of-Bounds Read / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1350 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit - WebCore::SimpleLineLayout::RunResolver::runForPoint Out-of-Bounds Read

WebKit - WebCore::SimpleLineLayout::RunResolver::runForPoint Out-of-Bounds Read / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1349 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit - WebCore::InputType::element Use-After-Free (2)

WebKit - WebCore::InputType::element Use-After-Free 2 / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1345 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit - WebCore::Style::TreeResolver::styleForElement Use-After-Free

WebKit - WebCore::Style::TreeResolver::styleForElement Use-After-Free function eventhandler1 try txt.appendChildkg; catche function eventhandler2 try anim.appendChildkg; catche function eventhandler3 try table.scrollIntoViewtrue; catche a !--...

WebKit - WebCore::FormSubmission::create Use-After-Free Exploit

Exploit for multiple platform in category dos / poc...

Webkit WebCore::SimpleLineLayout::RunResolver::runForPoint Out-Of-Bounds Read

WebKit: out-of-bounds read in WebCore::SimpleLineLayout::RunResolver::runForPoint CVE-2017-13784 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: =================================================================...

WebKit - WebCore::SimpleLineLayout::RunResolver::runForPoint Out-of-Bounds Read Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1349 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit - WebCore::SVGPatternElement::collectPatternAttributes Out-of-Bounds Read Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1350 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit Component Memory Corruption Vulnerability in Multiple Apple Products (CNVD-2017-37838)

Apple iOS, iCloud for Windows, iTunes for Windows, Safari, and tvOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. WebKit is an open source web...

WebKit - WebCore::PositionIterator::decrement Use-After-Free Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1346 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...

WebKit WebCore::Style::TreeResolver::styleForElement Use-After-Free

WebKit: use-after-free in WebCore::Style::TreeResolver::styleForElement CVE-2017-13802 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function...

WebKit - WebCore::Style::TreeResolver::styleForElement Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function eventhandler1 try txt.appendChildkg; catche function eventhandler2 try anim.appendChildkg; catche function eventhandler3 try table.scrollIntoViewtrue; catche a !-- ================================================================= ASan...