Microsoft Internet Explorer 8 / 9 / 10 / 11 MSHTML - DOMImplementation Type Confusion Exploit

Exploit for windows platform in category dos / poc Source: http://blog.skylined.nl/20161128001.html Synopsis A specially crafted web-page can cause a type confusion vulnerability in Microsoft Internet Explorer 8 through to 11. An attacker can cause code to be executed with a stack layout it does...

Microsoft Internet Explorer 891011 - MSHTML DOMImplementation Type Confusion (MS16-009)

Microsoft Internet Explorer 891011 - MSHTML DOMImplementation Type Confusion MS16-009 Source: http://blog.skylined.nl/20161128001.html Synopsis A specially crafted web-page can cause a type confusion vulnerability in Microsoft Internet Explorer 8 through to 11. An attacker can cause code to be...

Microsoft Internet Explorer 11 - MSHTML 'CGenerated­Content::Has­Generated­SVGMarker' Type Confusion

window.onload = function document.get­Elements­By­Tag­Name"iframe"0.src = "repro-iframe.html"; Description Internally MSIE uses various lists of linked CTree­Pos objects to represent the DOM tree. For HTML/SVG elements a CTree­Node element is created, which embeds two CTree­Pos instances: one tha...

Microsoft Internet Explorer 8/9/10/11 - MSHTML 'DOMImplementation' Type Confusion (MS16-009)

Source: http://blog.skylined.nl/20161128001.html Synopsis A specially crafted web-page can cause a type confusion vulnerability in Microsoft Internet Explorer 8 through to 11. An attacker can cause code to be executed with a stack layout it does not expect, or have code attempt to execute a metho...

Microsoft Internet Explorer 11 - MSHTML CGenerated­Content::Has­Generated­SVGMarker Type Confusion

Microsoft Internet Explorer 11 - MSHTML CGenerated­Content::Has­Generated­SVGMarker Type Confusion window.onload = function document.get­Elements­By­Tag­Name"iframe"0.src = "repro-iframe.html"; Description Internally MSIE uses various lists of linked CTree­Pos objects to represent the DOM tree. F...

Microsoft Internet Explorer 10 - MSHTML 'CEdit­Adorner::Detach' Use-After-Free (MS13-047)

var o­Window = window.open"window.xhtml"; set­Intervalfunction try o­Window.eval"" + function document.design­Mode = "on"; document.exec­Command"Select­All"; var o­Selection = window.get­Selection; o­Selection.collapsedocument,1; document.exec­Command"Insert­Image", false;...

Microsoft Internet Explorer 10 MSHTML CEditAdorner::Detach Use-After-Free

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the nineteenth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throu...

Microsoft Internet Explorer 8 MSHTML - 'Ptls5::Ls­Find­Span­Visual­Boundaries' Memory Co

Exploit for windows platform in category dos / poc 0day.today 2018-01-02...

Microsoft Internet Explorer 8 jscript - 'Reg­Exp­Base::FBad­Header' Use-After-Free (MS15

Exploit for windows platform in category dos / poc // This Po­C attempts to exploit a use-after-free bug in Microsoft Internet // Explorer 8. // See http://blog.skylined.nl/20161116001.html for details. var r=new Reg­Exp"A|x|x|xx|xxxxxxxxxxxxxxxxxxxx+", "g"; "A".replacer, function // Force OLEAUT...

Microsoft Internet Explorer 8 8 MSHTML SRunPointer::SpanQualifier/RunType Out-Of-Bounds Read

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the sixteenth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throug...

Microsoft Internet Explorer 8 - MSHTML Ptls5::Ls­Find­Span­Visual­Boundaries Memory Corruption

Microsoft Internet Explorer 8 - MSHTML Ptls5::Ls­Find­Span­Visual­Boundaries Memory Corruption...

Microsoft Internet Explorer 8 - MSHTML 'Ptls5::Ls­Find­Span­Visual­Boundaries' Memory Corruption

...

Microsoft Internet Explorer 8 - jscript 'Reg­Exp­Base::FBad­Header' Use-After-Free (MS15-018)

// This Po­C attempts to exploit a use-after-free bug in Microsoft Internet // Explorer 8. // See http://blog.skylined.nl/20161116001.html for details. var r=new Reg­Exp"A|x|x|xx|xxxxxxxxxxxxxxxxxxxx+", "g"; "A".replacer, function // Force OLEAUT32 to free the string for var j = 0; j !--...

Microsoft Internet Explorer 8 - jscript Reg­Exp­Base::FBad­Header Use-After-Free (MS15-018)

Microsoft Internet Explorer 8 - jscript Reg­Exp­Base::FBad­Header Use-After-Free MS15-018 // This Po­C attempts to exploit a use-after-free bug in Microsoft Internet // Explorer 8. // See http://blog.skylined.nl/20161116001.html for details. var r=new Reg­Exp"A|x|x|xx|xxxxxxxxxxxxxxxxxxxx+", "g";...

Microsoft Internet Explorer 8 Javascript RegExpBase::FBadHeader Use-After-Free

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the twelfth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these through...

CVE-2016-7199

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the Same Origin Policy and obtain sensitive window-state information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."...

Memory corruption

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," as demonstrated by the Chakra...

CVE-2016-7202

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," as demonstrated by the Chakra...

Microsoft Internet Explorer 11/10/9 - MSHTML 'PROPERTYDESC::Handle­Style­Component­Property' Out-of-Bounds Read (MS16-104)

// This Po­C attempts to exploit a memory disclosure bug in Microsoft Internet // Explorer 11. On x64 systems, this should cause an access violation when // run with page-heap enabled, as the code attempts to read a byte // immediately following a 4 byte memory block. // See...

WININET CHttpHeaderParser::ParseStatusLine Out-Of-Bounds Read

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the eight entry in that series, although this particular vulnerability does not just affect web-browsers, but all applications that use WININET to make HTTP requests...