WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free

WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free ::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try...

WebKit - WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free

WebKit - WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free function eventhandler2 try var var00138 = svgvar00013.parentNode; catche try htmlvar00006.setAttribute"onfocusin", "eventhandler2"; catche try svgvar00001.aftervar00138; catche function eventhandler5 try...

WebKit - WebCore::SVGTRefElement::updateReferencedText Use-After-Free

WebKit - WebCore::SVGTRefElement::updateReferencedText Use-After-Free function freememory forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69919==ERROR: AddressSanitizer:...

WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free

WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer:...

WebKit - WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free

WebKit - WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free htmlvar00002, htmlvar00006 column-span: all; :root 1px; position: fixed; -webkit-column-width: 1px; .class2 text-indent: -webkit-shape-margin: 0px; -webkit-writing-mode: vertical-rl; '.' defselement, .class8 display:...

WebKit - WebCore::Node::ensureRareData Use-After-Free

WebKit - WebCore::Node::ensureRareData Use-After-Free .class1 -webkit-mask-box-image-source: urlfoo; function freememory var a; forvar i=0;i100;i++ a = new Uint8Array10241024; document.implementation.createHTMLDocument"doc"; function jsfuzzer try var00097 = document.createElement"source"; catche...

WebKit WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free

WebKit: Use-after-free in WebCore::AXObjectCache::handleMenuItemSelected CVE-2018-4312 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. Note that accessibility features need to be enabled in order to...

WebKit WebCore::InlineTextBox::paint Out-Of-Bounds Read

WebKit: Out-of-bounds read in WebCore::InlineTextBox::paint CVE-2018-4328 There is a out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233419 on OSX. The vulnerability has also been confirmed on Safari 11.1.1 sources grabbed...

WebKit WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free

WebKit: Use-after-free in WebCore::RenderMultiColumnSet::updateMinimumColumnHeight CVE-2018-4323 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233419 on OSX. The vulnerability has also been confirmed on Safari 11.1...

WebKit WebCore::SVGTextLayoutAttributes::context Use-After-Free

WebKit: Use-after-free in WebCore::SVGTextLayoutAttributes::context CVE-2018-4318 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC: ================================================================...

WebKit WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free

WebKit: Use-after-free in WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded CVE-2018-4197 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...

WebKit WebCore::Node::ensureRareData Use-After-Free

WebKit: Use-after-free in WebCore::Node::ensureRareData CVE-2018-4306 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. PoC: ================================================================= .class1...

WebKit WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free

WebKit: Use-after-free in WebCore::RenderLayer::updateDescendantDependentFlags CVE-2018-4317 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...

WebKit WebCore::SVGTRefElement::updateReferencedText Use-After-Free

WebKit: Use-after-free in WebCore::SVGTRefElement::updateReferencedText CVE-2018-4315 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. PoC:...

WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read

WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read -webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 =...

WebKit WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free

WebKit: Use-after-free in WebCore::SVGAnimateElementBase::resetAnimatedType CVE-2018-4314 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try...

WebKit - WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free

WebKit - WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free htmlvar00005, noframes, diplay: inline; padding-top: 0vw; -webkit-column-count: 41; transition-delay: body::first-letter box-flex-group: -webkit-background-size: contain; -webkit-opacity: 0.716727864979; htmlvar00001,...

WebKit - 'WebCore::AXObjectCache::handleMenuItemSelected' Use-After-Free

function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120000aaa54 at pc 0x0003280b861a bp...

WebKit - 'WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded' Use-After-Free

::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try var00034.setPositionhtmlvar00003; var var00043 catche try / newvarvar00104:Element / var var00104 = htmlvar00013;...