Microsoft Edge Scripting Engine CVE-2017-11806 Remote Memory Corruption Vulnerability

Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft ChakraCore Microsoft...

The vulnerability in Microsoft Edge browsers arises from an operation that goes beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Edge arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...

Microsoft Edge Chakra - Incorrectly Parses Object Patterns Exploit

Exploit for windows platform in category dos / poc function f a: b = 0x1111, c = 0x2222, .c = 0x3333 = ; f; 0day.today 2018-02-05...

Microsoft Edge Chakra Parser::ParseCatch Failed eval Handle

Microsoft Edge: Chakra: Parser::ParseCatch doesn't handle "eval" CVE-2017-11764 In Javascript, the code executed by a direct call to eval shares the caller block's scopes. Chakra handles this from the parser. And there's a bug when it parses "eval" in a catch statement's param. ParseNodePtr...

Microsoft Edge Chakra Incorrect Parse

Microsoft Edge: Chakra incorrectly parses object patterns CVE-2017-8729 When the Chakra's parser meets "", at first, Chakra treats it as an object literal without distinguishing whether it will be an object literali.e., a: 0x1234 or an object patterni.e., a = a: 1234. After finishing to parse it...

Microsoft Edge Chakra JavascriptFunction::ReparseAsmJsModule Parsing Issue

Microsoft Edge: Chakra: JavascriptFunction::ReparseAsmJsModule incorrectly re-parses CVE-2017-8755 This is similar to the issue 1271 . Here's the method used to re-parse asmjs modules. void JavascriptFunction::ReparseAsmJsModuleScriptFunction functionRef ParseableFunctionInfo functionInfo =...

Microsoft Edge Chakra - Parser::ParseCatch does not Handle (eval) Exploit

Exploit for windows platform in category dos / poc PnodeBlockType::Regular, isPattern ? ScopeTypeCatchParamPattern : ScopeTypeCatch; ... ParseNodePtr pnodePattern = ParseDestructuredLiteraltkLET, true /isDecl/, true /topLevel/, DICForceErrorOnInitializer; ... 1. "pnodeCatchScope" is a temporary...

Microsoft Edge Charka Wrong Scopes In Deferred Parsing

Microsoft Edge: Chakra: Deferred parsing makes wrong scopes CVE-2017-8740 function fa = function printa; with ; function g f; ; When Chakra executes the above code, it doesn't generate bytecode for "g". This is a feature called "DeferParse". The problem is that the bytecode generated for "f" when...

Microsoft Edge Chakra - Parser::ParseCatch Does Not Handle eval() (Denial of Service)

Microsoft Edge Chakra - Parser::ParseCatch Does Not Handle eval Denial of Service PnodeBlockType::Regular, isPattern ? ScopeTypeCatchParamPattern : ScopeTypeCatch; ... ParseNodePtr pnodePattern = ParseDestructuredLiteraltkLET, true /isDecl/, true /topLevel/, DICForceErrorOnInitializer; ... 1...

Microsoft Edge Chakra - JavascriptFunction::ReparseAsmJsModule Incorrectly Re-parses

Microsoft Edge Chakra - JavascriptFunction::ReparseAsmJsModule Incorrectly Re-parses GetParseableFunctionInfo; AssertfunctionInfo; functionInfo-GetFunctionBody-AddDeferParseAttribute; functionInfo-GetFunctionBody-ResetEntryPoint; functionInfo-GetFunctionBody-ResetInParams; FunctionBody funcBody =...

Microsoft Edge Chakra - 'JavascriptFunction::ReparseAsmJsModule' Incorrectly Re-parses

GetParseableFunctionInfo; AssertfunctionInfo; functionInfo-GetFunctionBody-AddDeferParseAttribute; functionInfo-GetFunctionBody-ResetEntryPoint; functionInfo-GetFunctionBody-ResetInParams; FunctionBody funcBody = functionInfo-ParsefunctionRef; if ENABLEPROFILEINFO // This is the first call to the...

Microsoft Edge Chakra - JavascriptFunction::ReparseAsmJsModule Incorrectly Re-parses Exploit

Exploit for windows platform in category dos / poc GetParseableFunctionInfo; AssertfunctionInfo; functionInfo-GetFunctionBody-AddDeferParseAttribute; functionInfo-GetFunctionBody-ResetEntryPoint; functionInfo-GetFunctionBody-ResetInParams; FunctionBody funcBody = functionInfo-ParsefunctionRef; if...

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes GetFuncExprNameReference || funcInfo-funcExprScope && funcInfo-funcExprScope-GetIsObject ... Js::RegSlot ldFuncExprDst = sym-GetLocation; this-mwriter.Reg1Js::OpCode::LdFuncExpr, ldFuncExprDst; if sym-IsInSlotfuncInfo Js::RegSlot...

Microsoft Edge - Chakra Incorrectly Parses Object Patterns

Microsoft Edge - Chakra Incorrectly Parses Object Patterns function f a: b = 0x1111, c = 0x2222, .c = 0x3333 = ; f;...

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes Exploit

Exploit for windows platform in category dos / poc GetFuncExprNameReference || funcInfo-funcExprScope && funcInfo-funcExprScope-GetIsObject ... Js::RegSlot ldFuncExprDst = sym-GetLocation; this-mwriter.Reg1Js::OpCode::LdFuncExpr, ldFuncExprDst; if sym-IsInSlotfuncInfo Js::RegSlot scopeLocation;...

Microsoft Edge Chakra - 'Parser::ParseCatch' Does Not Handle 'eval()' (Denial of Service)

PnodeBlockType::Regular, isPattern ? ScopeTypeCatchParamPattern : ScopeTypeCatch; ... ParseNodePtr pnodePattern = ParseDestructuredLiteraltkLET, true /isDecl/, true /topLevel/, DICForceErrorOnInitializer; ... 1. "pnodeCatchScope" is a temporary block used to create a scope, and it is not actually...

Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes

GetFuncExprNameReference || funcInfo-funcExprScope && funcInfo-funcExprScope-GetIsObject ... Js::RegSlot ldFuncExprDst = sym-GetLocation; this-mwriter.Reg1Js::OpCode::LdFuncExpr, ldFuncExprDst; if sym-IsInSlotfuncInfo Js::RegSlot scopeLocation; AnalysisAssertfuncInfo-funcExprScope; if...

Microsoft Edge - Chakra Incorrectly Parses Object Patterns

function f a: b = 0x1111, c = 0x2222, .c = 0x3333 = ; f;...

Microsoft Edge 38.14393.1066.0 - Memory Corruption with Partial Page Loading

Microsoft Edge 38.14393.1066.0 - Memory Corruption with Partial Page Loading Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1309 There is a security issue in Microsoft Edge related to how HTML documents are loaded. If Edge displays a HTML document from a slow HTTP server, it is...

Microsoft Edge 38.14393.1066.0 - Memory Corruption with Partial Page Loading

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1309 There is a security issue in Microsoft Edge related to how HTML documents are loaded. If Edge displays a HTML document from a slow HTTP server, it is possible that a part of the document is going to be rendered before the serv...