Microsoft Internet Explorer 11 - MSHTML CSplice­Tree­Engine::Remove­Splice Use-After-Free (MS14-035)

Microsoft Internet Explorer 11 - MSHTML CSplice­Tree­Engine::Remove­Splice Use-After-Free MS14-035 document.add­Event­Listener"DOMNode­Removed", function document.open; // free // attempt to modify freed memory here // because it will be...

Microsoft Internet Explorer 11 - MSHTML CSplice­Tree­Engine::Remove­Splice Use-After-Free (MS14-035)

document.add­Event­Listener"DOMNode­Removed", function document.open; // free // attempt to modify freed memory here // because it will be reused after this function returns. , true; window.onload = function docume...

Microsoft Internet Explorer 9 IEFRAME CView::EnsureSize Use-After-Free

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the 34th entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161216001.html. There you can find a repro that triggered this...

Microsoft Internet Explorer 9 - IEFRAME CMarkup­Pointer::Move­To­Gap Use-After-Free

!-- Source: http://blog.skylined.nl/20161215001.html Synopsis A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. The use appears to happen only once almost immediately after the free, which makes practical exploitation unlikely. Known affecte...

Microsoft Internet Explorer 9 - IEFRAME CView::Ensure­Size Use-After-Free (MS13-021)

Microsoft Internet Explorer 9 - IEFRAME CView::Ensure­Size Use-After-Free MS13-021 var o­Element = document.get­Element­By­Id"ruby"; var o­Element = o­Element.parent­Node.remove­Childo­Element; document.write""; document.document­Element.offset­Top; set­Timeout"location.reload", 100; !-- Time-lin...

Microsoft Internet Explorer 9 - IEFRAME CMarkup­Pointer::Move­To­Gap Use-After-Free

Microsoft Internet Explorer 9 - IEFRAME CMarkup­Pointer::Move­To­Gap Use-After-Free !-- Source: http://blog.skylined.nl/20161215001.html Synopsis A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. The use appears to happen only once almost...

Microsoft Internet Explorer 9 IEFRAME - CMarkup::Remove­Pointer­Pos Use-After-Free (MS13-055) Exploi

Exploit for windows platform in category dos / poc document.add­Event­Listener"load", function document.document­Element.remove­Nodetrue; , true; document.add­Event­Listener"DOMNode­Removed", function document.write""; , true; !-- Time-line Sometime in November 2012: This vulnerability was found...

Microsoft Internet Explorer 9 - IEFRAME CView::Ensure­Size Use-After-Free (MS13-021)

var o­Element = document.get­Element­By­Id"ruby"; var o­Element = o­Element.parent­Node.remove­Childo­Element; document.write""; document.document­Element.offset­Top; set­Timeout"location.reload", 100; !-- Time-line Sometime in October 2012: This vulnerability was found through fuzzing. 29 Octobe...

Microsoft Internet Explorer 9 MSHTML - CMarkup::Reload­In­Compat­View Use-After-Free Exploit

Exploit for windows platform in category dos / poc document.design­Mode = "on"; !-- Details By switching the a document's design­Mode property to on in a deferred script, MSIE 9 can be made to reload a web page using CMarkup::Reload­In­Compat­View. This method calls CDoc::Compat­View­Refresh, whi...

Microsoft Internet Explorer 9 - IEFRAME CMarkup::Remove­Pointer­Pos Use-After-Free (MS13-055)

Microsoft Internet Explorer 9 - IEFRAME CMarkup::Remove­Pointer­Pos Use-After-Free MS13-055 document.add­Event­Listener"load", function document.document­Element.remove­Nodetrue; , true; document.add­Event­Listener"DOMNode­Removed", function document.write""; , true; !-- Time-line Sometime in...

Microsoft Internet Explorer 9 - MSHTML CMarkup::Reload­In­Compat­View Use-After-Free

document.design­Mode = "on"; !-- Details By switching the a document's design­Mode property to on in a deferred script, MSIE 9 can be made to reload a web page using CMarkup::Reload­In­Compat­View. This method calls CDoc::Compat­View­Refresh, which indirectly calls...

Vulnerabilities of Microsoft Edge and Internet Explorer browsers, which allow attackers to obtain confidential information or perform XSS attacks

The vulnerability of the RegEx XSS-filter in Microsoft Edge and Internet Explorer exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform XSS attacks or obtain confidential information remotely...

The vulnerabilities of browsers Internet Explorer and Microsoft Edge allow attackers to access the content of local files.

The vulnerability of browsers Internet Explorer and Microsoft Edge is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to access the content of local files remotely...

Microsoft Internet Explorer 9 - IEFRAME CMarkup::Remove­Pointer­Pos Use-After-Free (MS13-055)

document.add­Event­Listener"load", function document.document­Element.remove­Nodetrue; , true; document.add­Event­Listener"DOMNode­Removed", function document.write""; , true; !-- Time-line Sometime in November 2012: This vulnerability was found through fuzzing. 11 November 2012: This vulnerabili...

Microsoft Internet Explorer 9 MSHTML CMarkup::ReloadInCompatView Use-After-Free

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the thirty-first entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161213001.html. There you can find a repro that triggered...

Microsoft Internet Explorer 9 IEFRAME CMarkup..RemovePointerPos Use-After-Free

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the 32nd entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161214001.html. There you can find a repro that triggered this...

Microsoft Internet Explorer 9 IEFRAME CMarkupPointer::MoveToGap Use-After-Free

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the 33rd entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161215001.html. There you can find a repro that triggered this...

Microsoft Internet Explorer 9 - MSHTML CMarkup::Reload­In­Compat­View Use-After-Free

Microsoft Internet Explorer 9 - MSHTML CMarkup::Reload­In­Compat­View Use-After-Free document.design­Mode = "on"; !-- Details By switching the a document's design­Mode property to on in a deferred script, MSIE 9 can be made to reload a web page using CMarkup::Reload­In­Compat­View. This method...

The vulnerabilities of browsers Internet Explorer and Microsoft Edge allow attackers to trigger service failures or execute arbitrary code.

The vulnerabilities of Internet Explorer and Microsoft Edge are caused by operations that go beyond the buffer boundaries in memory. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code or cause a service failure memory corruption through a specially crafted web pag...

Flash Player Bug An Eavesdropper's Delight

Adobe yesterday patched a not-so-sweet 16 Flash Player vulnerabilities, including a zero day under attack. While not much is known about the targeted attacks using the Flash Player bug, or its victims, details have surfaced on another patched flaw that is a potential privacy nightmare...