Apple Safari WebKit Memory Corruption Vulnerability (CNVD-2017-01635)

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems.WebKit is a set of open source web browser engines. A memory corruption vulnerability exists in Apple Safari WebKit, which can be exploited by remote attackers to...

Apple Safari WebKit Security Bypass Vulnerability (CNVD-2017-01776)

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems.WebKit is a set of open source web browser engines developed by the KDE community. A security bypass vulnerability exists in Apple Safari WebKit, which can be exploited ...

Apple Safari WebKit Memory Corruption Vulnerability (CNVD-2017-01636)

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. WebKit is a set of open source web browser engines developed by the KDE community. A memory corruption vulnerability exists in Apple Safari WebKit, which can be exploit...

Design/Logic Flaw

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

CVE-2016-9642

Removed by vendor...

CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

CVE-2016-9642

CVE-2016-9642 affects WebKit's JavaScriptCore in WebKitGTK+ (WebKitGTK+ up to version before 2.16.0) and WebKit/WebKitGTK+ deployments. The root cause is an out-of-bounds heap read triggered by a crafted Javascript file, leading to a denial of service. Public advisories (e.g., ASA-201704-9 for Ar...

UBUNTU-CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

Apple WebKit - HTMLFormElement::reset() Use-After Free Exploit

Exploit for macOS platform in category dos / poc function go output.value = "aaa"; output.appendChildinserteddiv; document.getElementById"output".addEventListener'DOMSubtreeModified', function forvar i=0; i foo associatedElement downcastassociatedElement.reset; The issue is that while...

Apple WebKit - 'HTMLFormElement::reset()' Use-After Free

function go output.value = "aaa"; output.appendChildinserteddiv; document.getElementById"output".addEventListener'DOMSubtreeModified', function forvar i=0; i foo associatedElement downcastassociatedElement.reset; The issue is that while massociatedElements vector is being iterated, its content ca...

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled function boom m.append"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; m.setAttribute"aria-labeledby", "t"; d.open = false; foo firstChild; The function expects that the first child is going to be of type...

Apple WebKit - HTMLFormElement::reset() Use-After Free

Apple WebKit - HTMLFormElement::reset Use-After Free function go output.value = "aaa"; output.appendChildinserteddiv; document.getElementById"output".addEventListener'DOMSubtreeModified', function forvar i=0; i foo associatedElement downcastassociatedElement.reset; The issue is that while...

Apple WebKit Renderbox Type Confusion

Apple WebKit: Type confusion in RenderBox with accessibility enabled CVE-2017-2373 There is a type confusion vulnerability that affects WebKit with accessibility enabled WebCore::AXObjectCache::gAccessibilityEnabed. PoC: =============================== function boom...

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled Exploit

Exploit for multiple platform in category dos / poc function boom m.append"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; m.setAttribute"aria-labeledby", "t"; d.open = false; foo firstChild; The function expects that the first child is going to be of type RenderBox, but in...

Apple WebKit HTMLKeygenElement Type Confusion

Apple WebKit: Type confusion in HTMLKeygenElement CVE-2017-2369 PoC: var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true; What happens here: 1. caretRangeFromPoint allows accessing...

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled

function boom m.append"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; m.setAttribute"aria-labeledby", "t"; d.open = false; foo firstChild; The function expects that the first child is going to be of type RenderBox, but in the PoC it is actually of type RenderText. This was...

Apple WebKit - HTMLKeygenElement Type Confusion

Apple WebKit - HTMLKeygenElement Type Confusion var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true;...