153 matches found
WebKit JSC JIT JSPropertyNameEnumerator Type Confusion
WebKit: JSC: JIT: A bug with JSPropertyNameEnumerator CVE-2018-4416 When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the information of the input object to the for-in loop. Inside the loop, the structure ID of the "this" object of eve...
WebKit JSC ForInContext Invalidation
WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary doesn't invalidate the ForInContext object. CVE-2018-4386 This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the...
WebKit JSC JIT - JSPropertyNameEnumerator Type Confusion Exploit
WebKit JSC JIT - JSPropertyNameEnumerator Type Confusion Exploit / When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the information of the input object to the for-in loop. Inside the loop, the structure ID of the "this" object of ever...
WebKit JSC JIT - ByteCodeParser::handleIntrinsicCall Type Confusion Exploit
WebKit JIT - ByteCodeParser::handleIntrinsicCall Type Confusion Exploit / case ArrayPushIntrinsic: ... if staticcastargumentCountIncludingThis = MINSPARSEARRAYINDEX return false; ArrayMode arrayMode = getArrayModemcurrentInstructionOPCODELENGTHopcall - 2.u.arrayProfile, Array::Write; ... This cod...
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the 'ForInContext' Object
/ This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding ForInContext object, but it doesn't. As a result, an arbitrary object can be passed as the property variable to the...
WebKit JSC JIT - 'JSPropertyNameEnumerator' Type Confusion
/ When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the information of the input object to the for-in loop. Inside the loop, the structure ID of the "this" object of every getbyid expression taking the loop variable as the index is...
WebKit JSC JIT - JSPropertyNameEnumerator Type Confusion
WebKit JSC JIT - JSPropertyNameEnumerator Type Confusion / When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the information of the input object to the for-in loop. Inside the loop, the structure ID of the "this" object of every getbyi...
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Exploit
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the ForInContext Object / This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding...
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the ForInContext Object
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the ForInContext Object / This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding...
jsc: Stack-use-after-scope in JSC::MarkedBlock::vm
Detailed report: https://oss-fuzz.com/testcase?key=5635965041770496 Project: jsc Fuzzer: jsfuzzer Job Type: asanjsc Platform Id: linux Crash Type: Stack-use-after-scope READ 8 Crash Address: 0x7fffb7b6bed8 Crash State: JSC::MarkedBlock::vm JSC::JSObject JSC::jsCast JSC::asObject Sanitizer: addres...
jsc: Heap-buffer-overflow in JSC::WriteBarrierBase<JSC::Unknown, WTF::DumbValueTraits<JSC::Unknown> >::get
Detailed report: https://oss-fuzz.com/testcase?key=5648470396895232 Project: jsc Fuzzer: jsfuzzer Job Type: asanjsc Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x62d000060000 Crash State: JSC::WriteBarrierBase ::get JSC::arrayProtoFuncIndexOf jsc Sanitizer: address...
jsc: Crash in jsc
Detailed report: https://oss-fuzz.com/testcase?key=4834384677961728 Project: jsc Fuzzer: jsfuzzer Job Type: asanjsc Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f1d25292ffe Crash State: jsc JSC::callWebAssemblyFunction jsc Sanitizer: address ASAN Regressed:...
CVE-2018-12294
WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object...
jsc: Crash in jsc
Detailed report: https://oss-fuzz.com/testcase?key=5358510706524160 Project: jsc Fuzzer: jsfuzzer Job Type: asanjsc Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0c21ce9afa94 Crash State: jsc jsc JSC::JITCode::execute Sanitizer: address ASAN Regressed:...
jsc: Heap-buffer-overflow in JSC::IndexingHeader::vectorLength
Detailed report: https://oss-fuzz.com/testcase?key=5694527739265024 Project: jsc Fuzzer: jsfuzzer Job Type: asanjsc Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x62d000060004 Crash State: JSC::IndexingHeader::vectorLength JSC::Butterfly::computeIndexingMask...
WebKit - WebCore::SimpleLineLayout::RunResolver::runForPoint Out-of-Bounds Read Exploit
Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1349 There is an out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC:...
jsc: Stack-use-after-scope in JSC::Register::pointer
Detailed report: https://oss-fuzz.com/testcase?key=5872251053277184 Project: jsc Fuzzer: jsfuzzer Job Type: asanjsc Platform Id: linux Crash Type: Stack-use-after-scope READ 8 Crash Address: 0x7ffe827c8008 Crash State: JSC::Register::pointer JSC::ExecState::unsafeCallee...
jsc: Heap-buffer-overflow in JSC::WeakSet::vm
Detailed report: https://oss-fuzz.com/testcase?key=6450936961564672 Project: jsc Fuzzer: jsfuzzer Job Type: asanjsc Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6230000038f8 Crash State: JSC::WeakSet::vm JSC::JSCell::structure JSC::JSValue::dumpInContext Sanitizer:...
WebKit: JSC: Incorrect for-in optimization #2(CVE-2017-7117)
No description provided by source. The following PoC bypasses the fix for the https://www.seebug.org/vuldb/ssvid-96629. PoC: function f let o = ; for let i in xx: 0 for i of 0 printoi; f;...