Fedora: Security Advisory for chromium (FEDORA-2020-a1f140614b)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 32 Update: chromium-85.0.4183.83-1.fc32

Chromium is an open-source web browser, powered by WebKit Blink...

JITSploitation I: A JIT Bug

By Samuel Groß, Project Zero This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS...

JITSploitation III: Subverting Control Flow

Posted by Samuel Groß, Project Zero This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed i...

cairo 1.16.0 in cairo_ft_apply_variations() in cairo-ft-font.c would free memory using a free function incompatible with WebKit's fastMalloc leading to an application crash with a "free(): invalid pointer" error.

...

Safari Webkit JIT Exploit for iOS 7.1.2

This module exploits a JIT optimization bug in Safari Webkit. This allows us to write shellcode to an RWX memory section in JavaScriptCore and execute it. The shellcode contains a kernel exploit CVE-2016-4669 that obtains kernel rw, obtains root and disables code signing. Finally we download and...

Safari Webkit For iOS 7.1.2 JIT Optimization Bug Exploit

This Metasploit module exploits a JIT optimization bug in Safari Webkit. This allows us to write shellcode to an RWX memory section in JavaScriptCore and execute it. The shellcode contains a kernel exploit CVE-2016-4669 that obtains kernel rw, obtains root and disables code signing. Finally we...

WebKit On iOS PAC / JIT Hardening Bypass Vulnerability

PAC and JIT Hardening Bypass in WebKit on iOS As per discussions with email protected, Apple would like to treat the PAC bypass described here as a security vulnerability by itself. The bypass was initially reported without a deadline on May 6. After receiving the reply that they will treat it as...

Safari Webkit For iOS 7.1.2 JIT Optimization Bug

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Safari Webkit JIT Exploit for iOS 7.1.2', 'Description' = %q This module exploits a JIT optimization bug in Safari Webkit. This allows us to writ...

CVE-2020-15661

A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. This vulnerability affects Firefox for iOS 28...

[SECURITY] Fedora 31 Update: webkit2gtk3-2.28.4-3.fc31

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3...

Arbitrary Code Execution

Webkit2gtk is vulnerable to arbitrary code execution. The vulnerability exists as a use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content...

Arbitrary Code Execution

webkit2gtk is vulnerable arbitrary code execution. The vulnerability exists due to the bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONENEWUSER and the TIOCSTI ioctl. CLONENEWUSER could potentially be used to confuse xdg-desktop-portal, whic...

Cross-Site Scripting (XSS)

webkit is vulnerable to Cross-Site Scripting XSS. An input validation issue was addressed with improved input validation...

Unspecified Vulnerability in WebKit Page Loading Component of Multiple Apple Products

Apple Safari is a web browser that is the default browser that comes with Mac OS X and iOS. apple iOS is an operating system developed for mobile devices. apple tvOS is a smart TV operating system. webKit Page Loading is one of the page loading components. A security vulnerability exists in the...

[SECURITY] Fedora 31 Update: chromium-84.0.4147.89-1.fc31

Chromium is an open-source web browser, powered by WebKit Blink...

Fedora: Security Advisory for chromium (FEDORA-2020-bf684961d9)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 32 Update: chromium-84.0.4147.89-1.fc32

Chromium is an open-source web browser, powered by WebKit Blink...

CVE-2020-9895

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A remote attacker may be able to cause unexpected...

PT-2020-6884 · Apple +7 · Ipados +14

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 13.6 iPadOS versions prior to 13.6 tvOS versions prior to 13.4.8 watchOS versions prior to 6.2.8 Safari versions prior to 13.1.2 iTunes versions prior to 12.10.8 for Windows iCloud for Windows versions prior to 11.3 iClo...