WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try...

WebKit WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free

WebKit: Use-after-free in WebCore::AXObjectCache::handleMenuItemSelected CVE-2018-4312 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. Note that accessibility features need to be enabled in order to...

WebKit - 'WebCore::AXObjectCache::handleMenuItemSelected' Use-After-Free

function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120000aaa54 at pc 0x0003280b861a bp...

WebKit - 'WebCore::SVGAnimateElementBase::resetAnimatedType' Use-After-Free

function eventhandler2 try var var00138 = svgvar00013.parentNode; catche try htmlvar00006.setAttribute"onfocusin", "eventhandler2"; catche try svgvar00001.aftervar00138; catche function eventhandler5 try htmlvar00028.autofocus = true; catche try htmlvar00034.appendChildhtmlvar00006; catche !--...

WebKit - 'WebCore::RenderMultiColumnSet::updateMinimumColumnHeight' Use-After-Free

htmlvar00002, htmlvar00006 column-span: all; :root 1px; position: fixed; -webkit-column-width: 1px; .class2 text-indent: -webkit-shape-margin: 0px; -webkit-writing-mode: vertical-rl; '.' defselement, .class8 display: grid; 1s; function jsfuzzer / newvarhtmlvar00078:HTMLHRElement / htmlvar00078 =...

WebKit - 'WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded' Use-After-Free

::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try var00034.setPositionhtmlvar00003; var var00043 catche try / newvarvar00104:Element / var var00104 = htmlvar00013;...

WebKit - 'WebCore::InlineTextBox::paint' Out-of-Bounds Read

-webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 = document.getElementById"htmlvar00049"; var htmlvar00005 =...

WebKit - 'WebCore::RenderLayer::updateDescendantDependentFlags' Use-After-Free

htmlvar00005, noframes, diplay: inline; padding-top: 0vw; -webkit-column-count: 41; transition-delay: body::first-letter box-flex-group: -webkit-background-size: contain; -webkit-opacity: 0.716727864979; htmlvar00001, .class1 1vmax; display: contents; left: transform-style: inherit;...

WebKit - 'WebCore::SVGTextLayoutAttributes::context' Use-After-Free

tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try var00162.replaceWithhtmlvar00022; catche Text !--...

WebKit - 'WebCore::Node::ensureRareData' Use-After-Free

.class1 -webkit-mask-box-image-source: urlfoo; function freememory var a; forvar i=0;i100;i++ a = new Uint8Array10241024; document.implementation.createHTMLDocument"doc"; function jsfuzzer try var00097 = document.createElement"source"; catche try var00097.addEventListener"DOMSubtreeModified",...

WebKit - 'WebCore::SVGTRefElement::updateReferencedText' Use-After-Free

function freememory forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69919==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000090e14 at pc 0x00011551a61a bp 0x7ffee91562a0...

[SECURITY] Fedora 27 Update: chromium-69.0.3497.92-1.fc27

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 28 Update: chromium-69.0.3497.92-1.fc28

Chromium is an open-source web browser, powered by WebKit Blink...

Apple iOS 11.x - Webkit Filter Backdrop DoS Vulnerability

Document Title: =============== Apple iOS 11.x - Webkit Filter Backdrop DoS Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2150 View Video: https://www.youtube.com/watch?v=oKtF9q15Unw Release Date: ============= 2018-09-19 Vulnerability Laboratory ID...

Apple WebKit Use After Free Code Execution (CVE-2018-4318)

A use-after-free vulnerability exists in Apple WebKit. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apple WebKit Use After Free Code Execution (CVE-2018-4323)

A use-after-free vulnerability exists in Apple WebKit. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apple WebKit Use After Free Code Execution (CVE-2018-4314)

A use-after-free vulnerability exists in Apple WebKit. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apple WebKit Out Of Bounds Read (CVE-2018-4328)

A out of bounds read vulnerability exists in Apple Webkit. Successful exploitation of this vulnerability could allow a remote attacker to obtain sensitive information...

Apple WebKit Use After Free Code Execution (CVE-2018-4312)

A use-after-free vulnerability exists in Apple WebKit. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apple WebKit Use After Free Code Execution (CVE-2018-4315)

A use-after-free vulnerability exists in Apple WebKit. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...