Apple WebKit Frame::setDocument UXSS Exploit

Apple WebKit suffers from a UXSS via Frame::setDocument. Apple WebKit: UXSS via Frame::setDocument CVE-2017-2365 Here's a snippet of Frame::setDocument. void Frame::setDocumentRefPtr&& newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState !=...

Apple WebKit 10.0.2 - Frame::setDocument Universal Cross-Site Scripting

Apple WebKit 10.0.2 - Frame::setDocument Universal Cross-Site Scripting && newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState != Document::InPageCache mdoc-prepareForDestruction; mdoc = newDocument.copyRef; ... Before setting |mdoc| to |newDocument|, it...

Apple WebKit 10.0.2 - 'Frame::setDocument' Universal Cross-Site Scripting

&& newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState != Document::InPageCache mdoc-prepareForDestruction; mdoc = newDocument.copyRef; ... Before setting |mdoc| to |newDocument|, it calls |prepareForDestruction| that fires unload event handlers. If we call...

Apple WebKit: UXSS via Frame::setDocument (CVE-2017-2365)

Here's a snippet of Frame::setDocument. void Frame::setDocumentRefPtr&& newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState != Document::InPageCache mdoc-prepareForDestruction; mdoc = newDocument.copyRef; ... Before setting |mdoc| to |newDocument|, it calls...

Debian DLA-833-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts. CVE-2014-9888 Russell King found that on ARM systems, memory allocated for DMA buffers was mapped with executable permission. This made it easier to...

Debian: Security Advisory (DSA-3791-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2016-5031

The printframeinstbytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service out-of-bounds read via a crafted file...

Out-of-bounds

The dumpblock function in printsections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service out-of-bounds read via crafted frame data...

DEBIAN-CVE-2016-5036

The dumpblock function in printsections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service out-of-bounds read via crafted frame data...

CVE-2016-5036

The dumpblock function in printsections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service out-of-bounds read via crafted frame data...

CVE-2016-5036

The dumpblock function in printsections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service out-of-bounds read via crafted frame data...

PT-2017-8655

Name of the Vulnerable Software and Affected Versions libdwarf versions prior to 20160923 Description The issue allows remote attackers to cause a denial of service NULL pointer dereference via an object file with empty bss-like sections. This is due to a problem in the print frame inst bytes...

CVE-2016-5036: Out-of-bounds Read

The dumpblock function in printsections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service out-of-bounds read via crafted frame data...

PT-2017-8658

Name of the Vulnerable Software and Affected Versions libdwarf versions prior to 20160923 Description The issue allows remote attackers to cause a denial of service out-of-bounds read via a crafted file. This is due to a problem in the print frame inst bytes function. Recommendations For versions...

WebSummit: found a vulnerability in your website

the vulnerability in your website is something called clickjacking or x-frame options header not set . when X-frame options header is not included in the HTTP the attacker can attack your website by clickjacking. so what is x-frame options? The X-Frame-Options HTTP response header can be used to...

CVE-2016-9000

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct...

CVE-2016-9000

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct...

Cross site scripting

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct...

CVE-2016-9000

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct...

CVE-2016-9000

IBM InfoSphere DataStage is affected by CVE-2016-9000, a Cross‑Frame Scripting issue caused by insufficient HTML iframe protection. A remote attacker could entice a user to visit a crafted URL to load a page under the attacker’s control, enabling clickjacking or other client‑side browser attacks....