14167 matches found
Multiple Apple products WebKit cross-site scripting vulnerability (CNVD-2018-21003)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser shipped with the Mac OS X and iOS operating systems. iTunes for Windows is a media player and application for the Windows platform. WebKit is one of the web browser engine components...
WebKit Memory Misreference Vulnerability in Multiple Apple Products (CNVD-2018-20997)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser shipped with the Mac OS X and iOS operating systems. iTunes for Windows is a media player and application for the Windows platform. WebKit is one of the web browser engine components...
Multiple Apple Products WebKit Memory Corruption Vulnerability (CNVD-2018-24569)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser shipped with the Mac OS X and iOS operating systems. iTunes for Windows is a media player and application for the Windows platform. WebKit is one of the web browser engine components...
WebKit Memory Misreference Vulnerability in Multiple Apple Products (CNVD-2018-20999)
Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser shipped with the Mac OS X and iOS operating systems. iTunes for Windows is a media player and application for the Windows platform. WebKit is one of the web browser engine components...
WebKit - WebCore::Node::ensureRareData Use-After-Free
WebKit - WebCore::Node::ensureRareData Use-After-Free .class1 -webkit-mask-box-image-source: urlfoo; function freememory var a; forvar i=0;i100;i++ a = new Uint8Array10241024; document.implementation.createHTMLDocument"doc"; function jsfuzzer try var00097 = document.createElement"source"; catche...
WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free
WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try...
WebKit WebCore::SVGTRefElement::updateReferencedText Use-After-Free
WebKit: Use-after-free in WebCore::SVGTRefElement::updateReferencedText CVE-2018-4315 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. PoC:...
WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free
WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer:...
WebKit WebCore::SVGTextLayoutAttributes::context Use-After-Free
WebKit: Use-after-free in WebCore::SVGTextLayoutAttributes::context CVE-2018-4318 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC: ================================================================...
WebKit WebCore::Node::ensureRareData Use-After-Free
WebKit: Use-after-free in WebCore::Node::ensureRareData CVE-2018-4306 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. PoC: ================================================================= .class1...
WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read
WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read -webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 =...
WebKit - WebCore::SVGTRefElement::updateReferencedText Use-After-Free
WebKit - WebCore::SVGTRefElement::updateReferencedText Use-After-Free function freememory forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69919==ERROR: AddressSanitizer:...
WebKit WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free
WebKit: Use-after-free in WebCore::SVGAnimateElementBase::resetAnimatedType CVE-2018-4314 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...
WebKit WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free
WebKit: Use-after-free in WebCore::AXObjectCache::handleMenuItemSelected CVE-2018-4312 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. Note that accessibility features need to be enabled in order to...
WebKit - 'WebCore::SVGTextLayoutAttributes::context' Use-After-Free
tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try var00162.replaceWithhtmlvar00022; catche Text !--...
WebKit - 'WebCore::InlineTextBox::paint' Out-of-Bounds Read
-webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 = document.getElementById"htmlvar00049"; var htmlvar00005 =...
WebKit - WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free
WebKit - WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free function eventhandler2 try var var00138 = svgvar00013.parentNode; catche try htmlvar00006.setAttribute"onfocusin", "eventhandler2"; catche try svgvar00001.aftervar00138; catche function eventhandler5 try...
WebKit WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free
WebKit: Use-after-free in WebCore::RenderMultiColumnSet::updateMinimumColumnHeight CVE-2018-4323 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233419 on OSX. The vulnerability has also been confirmed on Safari 11.1...
WebKit WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free
WebKit: Use-after-free in WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded CVE-2018-4197 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...
WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free
WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free ::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try...