Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements

The Mozilla Foundation Security Advisory describes this flaw as: Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. A type confusion bug occurs when using logical assignment operators in JavaScript switch statements...

Oracle Linux 7 : firefox (ELSA-2021-0290)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-0290 advisory. 78.7.0-2.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs.j...

Microsoft Edge Chakra JIT - Type Confusion with switch Statements

Microsoft Edge Chakra JIT - Type Confusion with switch Statements / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1341&desc=3 Let's start with a switch statement and its IR code for JIT. JS: for let i = 0; i ; 100; i++ switch i case 2: case 4: case 6: case 8: case 10: case 12:...

Microsoft Edge Chakra JIT - Type Confusion with switch Statements Exploit

Exploit for windows platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1341&desc=3 Let's start with a switch statement and its IR code for JIT. JS: for let i = 0; i ; 100; i++ switch i case 2: case 4: case 6: case 8: case 10: case 12: case 14: case...

Microsoft Edge: Chakra: JIT: Type confusion with switch statements(CVE-2017-11811)

Let's start with a switch statement and its IR code for JIT. JS: for let i = 0; i ; 100; i++ switch i case 2: case 4: case 6: case 8: case 10: case 12: case 14: case 16: case 18: case 20: case 22: case 24: case 26: case 28: case 30: case 32: case 34: case 36: case 38: break; IRs before Type...

Microsoft Edge Chakra JIT - Type Confusion with switch Statements

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1341&desc=3 Let's start with a switch statement and its IR code for JIT. JS: for let i = 0; i ; 100; i++ switch i case 2: case 4: case 6: case 8: case 10: case 12: case 14: case 16: case 18: case 20: case 22: case 24: case 26: ca...