Chrome V8 TranslatedState::MaterializeCapturedObjectAt Caching Bug Exploit

Exploit for multiple platform in category dos / poc Chrome: V8: TranslatedState::MaterializeCapturedObjectAt caching bug Here'a snippet of TranslatedState::MaterializeCapturedObjectAt. case JSSETKEYVALUEITERATORTYPE: case JSSETVALUEITERATORTYPE: Handle object = Handle::cast...

Chrome V8 - PropertyArray Integer Overflow

Chrome V8 - PropertyArray Integer Overflow / Here's a snippet of the MigrateFastToFast function which is used to create a new PropertyArray object. int numberoffields = newmap-NumberOfFields; int inobject = newmap-GetInObjectProperties; int unused = newmap-UnusedPropertyFields; ... int totalsize ...

Chrome V8 PropertyArray Integer Overflow Exploit

Exploit for multiple platform in category dos / poc Chrome: V8: Integer overflow with PropertyArray There's a snippet of the MigrateFastToFast function which is used to create a new PropertyArray object. int numberoffields = newmap-NumberOfFields; int inobject = newmap-GetInObjectProperties; int...

Chrome V8 - 'TranslatedState::MaterializeCapturedObjectAt' Type Confusion

/ Here'a snippet of TranslatedState::MaterializeCapturedObjectAt. case JSSETKEYVALUEITERATORTYPE: case JSSETVALUEITERATORTYPE: Handle object = Handle::cast isolate-factory-NewJSObjectFromMapmap, NOTTENURED; Handle properties = materializer.FieldAtvalueindex; Handle elements =...

Chrome V8 TranslatedState::MaterializeCapturedObjectAt Caching Bug

Chrome: V8: TranslatedState::MaterializeCapturedObjectAt caching bug Here'a snippet of TranslatedState::MaterializeCapturedObjectAt. case JSSETKEYVALUEITERATORTYPE: case JSSETVALUEITERATORTYPE: Handle object = Handle::cast isolate-factory-NewJSObjectFromMapmap, NOTTENURED; Handle properties =...

Chrome V8 PropertyArray Integer Overflow

Chrome: V8: Integer overflow with PropertyArray There's a snippet of the MigrateFastToFast function which is used to create a new PropertyArray object. int numberoffields = newmap-NumberOfFields; int inobject = newmap-GetInObjectProperties; int unused = newmap-UnusedPropertyFields; ... int...

Google Chrome Unspecified Security Vulnerability (Feb 2018) - Mac OS X

Google Chrome is prone to an unspecified remote security vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

openSUSE: Security Advisory for chromium (openSUSE-SU-2018:0453-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Google Chrome Unspecified Security Vulnerability (Feb 2018) - Windows

Google Chrome is prone to an unspecified remote security vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security update for chromium (important)

This update for chromium to version 64.0.3282.167 fixes the following issue: CVE-2018-6056: Incorrect derived class instantiation in V8 bsc1080920...

Security update for chromium (important)

This update for chromium to version 64.0.3282.167 fixes the following issue: CVE-2018-6056: Incorrect derived class instantiation in V8 bsc1080920...

Chrome V8 - Runtime_RegExpReplace Integer Overflow

Chrome V8 - RuntimeRegExpReplace Integer Overflow / Here's a snippet of the method. ASSIGNRETURNFAILUREONEXCEPTION isolate, captureslengthobj, Object::ToLengthisolate, captureslengthobj; const int captureslength = PositiveNumberToUint32captureslengthobj; ... if functionalreplace const int argc =...

Google Chrome < 64.0.3282.167 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 64.0.3282.167. It is, therefore, affected by a vulnerability as referenced in the 201802stable-channel-update-for-desktop13 advisory. - Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prio...

Chrome V8 - Runtime_RegExpReplace Integer Overflow Exploit

Exploit for multiple platform in category dos / poc / Here's a snippet of the method. ASSIGNRETURNFAILUREONEXCEPTION isolate, captureslengthobj, Object::ToLengthisolate, captureslengthobj; const int captureslength = PositiveNumberToUint32captureslengthobj; ... if functionalreplace const int argc ...

Chrome V8 Runtime_RegExpReplace Integer Overflow

Chrome: V8: Integer overflow in RuntimeRegExpReplace Here's a snippet of the method. ASSIGNRETURNFAILUREONEXCEPTION isolate, captureslengthobj, Object::ToLengthisolate, captureslengthobj; const int captureslength = PositiveNumberToUint32captureslengthobj; ... if functionalreplace const int argc =...

Chrome V8 - 'Runtime_RegExpReplace' Integer Overflow

/ Here's a snippet of the method. ASSIGNRETURNFAILUREONEXCEPTION isolate, captureslengthobj, Object::ToLengthisolate, captureslengthobj; const int captureslength = PositiveNumberToUint32captureslengthobj; ... if functionalreplace const int argc = hasnamedcaptures ? captureslength + 3 :...

Google Chrome < 64.0.3282.167 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 64.0.3282.167. It is, therefore, affected by a vulnerability as referenced in the 201802stable-channel-update-for-desktop13 advisory. - Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior ...

CVE-2018-6056

Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.168 allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

KLA11194 Unspecified vulnerability in Google Chrome

An unspecified vulnerability was found in the component V8 in Google Chrome. By exploiting this vulnerability malicious users can cause denial of service and possibly execute arbitrary code. Original advisories Stable Channel Update for Desktop Related products Google-Chrome CVE list CVE-2018-605...

Google Chrome < 64.0.3282.140 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 64.0.3282.140. It is, therefore, affected by a vulnerability as referenced in the 201802stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the...