Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (2)

!-- Source: http://blog.skylined.nl/20161208001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability. Known...

Microsoft Internet Explorer 9 - MSHTML CElement::Has­Flag Memory Corruption

// First tag can be any inline but must NOT be closed yet // Second tag can be anything that's not inline. // "text1" can be anything document.write'text1'; // The tree is in good shape. show"DOM Tree after first write", get­Element­Treedocument.body; // At this point, it appears that MSIE is sti...

Microsoft Internet Explorer 9 MSHTML CElement::HasFlag Memory Corruption

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the twenty-ninth entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161209001.html. There you can find a repro that triggered...

Microsoft Internet Explorer 9 MSHTML CDispNode::InsertSiblingNode Use-After-Free

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the twenty-eighth entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161208001.html. There you can find a repro that triggere...

Hacking Millions with Just an Image — Recipe: Pixels, Ads & Exploit Kit

If you have visited any popular mainstream website over the past two months, your computer may have been infected — Thanks to a new exploit kit discovered by security researchers. Researchers from antivirus provider ESET released a report on Tuesday stating that they have discovered an exploit ki...

Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free (MS13-009)

Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free MS13-009 window.open"Repro.xml", "iframe"; set­Timeoutfunction window.open'javascript:voidlocation.href = "about:blank";', "iframe"; , 1000; Description This is the first security vulnerability I sold to ZDI after I quit my j...

Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free (MS13-009)

window.open"Repro.xml", "iframe"; set­Timeoutfunction window.open'javascript:voidlocation.href = "about:blank";', "iframe"; , 1000; Description This is the first security vulnerability I sold to ZDI after I quit my job at Google to live off security bug bounties. It appears I either did not analy...

Microsoft Internet Explorer 9 - 'jscript9' Java­Script­Stack­Walker Memory Corruption (MS15-056)

var o­Window = window.open"about:blank"; o­Window.exec­Script'window.o­URIError = new URIError;o­URIError.name = o­URIError;' try "" + o­Window.o­URIError; catche try "" + o­Window.o­URIError; catche Description A Javascript can construct an URIError object and sets that object's name property to...

Microsoft Internet Explorer jscript9 - Java­Script­Stack­Walker Memory Corruption (MS15-056)

Exploit for windows platform in category dos / poc var o­Window = window.open"about:blank"; o­Window.exec­Script'window.o­URIError = new URIError;o­URIError.name = o­URIError;' try "" + o­Window.o­URIError; catche try "" + o­Window.o­URIError; catche Description A Javascript can construct an...

Microsoft Internet Explorer 9 - jscript9 Java­Script­Stack­Walker Memory Corruption (MS15-056)

Microsoft Internet Explorer 9 - jscript9 Java­Script­Stack­Walker Memory Corruption MS15-056 var o­Window = window.open"about:blank"; o­Window.exec­Script'window.o­URIError = new URIError;o­URIError.name = o­URIError;' try "" + o­Window.o­URIError; catche try "" + o­Window.o­URIError; catche...

Microsoft Internet Explorer 9 jscript9 JavaScriptStackWalker Memory Corruption

Since November I have been releasing details on all vulnerabilities I found in web-browsers that I had not released before. I will try to continue to publish all my old vulnerabilities, including those not in web-browser, as long as I can find some time to do so. If you find this information...

Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free (MS13-009) Exploit

Exploit for windows platform in category dos / poc window.open"Repro.xml", "iframe"; set­Timeoutfunction window.open'javascript:voidlocation.href = "about:blank";', "iframe"; , 1000; Description This is the first security vulnerability I sold to ZDI after I quit my job at Google to live off...

Microsoft Internet Explorer 9 CDoc::ExecuteScriptUri Use-After-Free

Since November I have been releasing details on all vulnerabilities I found in web-browsers that I had not released before. I will try to continue to publish all my old vulnerabilities, including those not in web-browser, as long as I can find some time to do so. If you find this information...

The vulnerabilities of browsers Internet Explorer and Microsoft Edge allow attackers to trigger service failures or execute arbitrary code.

The vulnerabilities of browsers Internet Explorer and Microsoft Edge allow attackers to trigger service failures or execute arbitrary code...

The vulnerability of the Internet Explorer browser and the Windows operating system allows a perpetrator to trigger a service failure or execute arbitrary code.

The vulnerability of the Internet Explorer browser and the Windows operating system allows a perpetrator to trigger a service failure or execute arbitrary code...

Vulnerability of browsers Internet Explorer and Microsoft Edge, allowing attackers to detect the presence of arbitrary files

Vulnerability of browsers Internet Explorer and Microsoft Edge, allowing attackers to detect the presence of arbitrary files...

The vulnerability of the Internet Explorer browser and the Windows operating system allows a perpetrator to determine the presence of arbitrary files.

The vulnerability of the Internet Explorer browser and the Windows operating system allows a perpetrator to determine the presence of arbitrary files...

Microsoft Internet Explorer 11 MSHTML - CGenerated­Content::Has­Generated­SVGMarker

Exploit for windows platform in category dos / poc window.onload = function document.get­Elements­By­Tag­Name"iframe"0.src = "repro-iframe.html"; Description Internally MSIE uses various lists of linked CTree­Pos objects to represent the DOM tree. For HTML/SVG elements a CTree­Node element is...

Microsoft Internet Explorer 8 MSHTML - SRun­Pointer::Span­Qualifier/Run­Type Out-Of-Bounds Read (MS1

Exploit for windows platform in category dos / poc position­fixed position: fixed; position­relative position: relative; float­left float: left; complex float: left; width: 100%; complex:first-line clear: left; window.onload = function boom o­Element­float­left =...

Microsoft Internet Explorer 10 MSHTML - CEdit­Adorner::Detach Use-After-Free (MS13-047) Exploit

Exploit for windows platform in category dos / poc var o­Window = window.open"window.xhtml"; set­Intervalfunction try o­Window.eval"" + function document.design­Mode = "on"; document.exec­Command"Select­All"; var o­Selection = window.get­Selection; o­Selection.collapsedocument,1;...