WebKit WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free

WebKit: use-after-free in WebCore::AccessibilityNodeObject::textUnderElement CVE-2017-7048 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug...

WebKit WebCore::InputType::element Use-After-Free

WebKit: use-after-free in WebCore::InputType::element CVE-2017-7042 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= var runcount = 0; function go...

WebKit JSC - arrayProtoFuncSplice Uninitialized Memory Reference

WebKit JSC - arrayProtoFuncSplice Uninitialized Memory Reference lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if UNLIKELY!result throwOutOfMemoryErrorexec, scope; return encodedJSValue; // The result can have an ArrayStorage indexing type...

WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling

WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform CVE-2017-7056 Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit...

WebKit JSC - 'DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry)' Incorrect Scope Register Handling

scopeRegister; mcodeBlock| instead of |mcodeBlock|. But it doesn't. As a result, the scope register of |inlineStackEntry-mcodeBlock| may have an incorrect offset in the stack layout phase. PoC: -- function f function eval'1'; f; ; throw 1; f;...

WebKit JSC - 'arrayProtoFuncSplice' Uninitialized Memory Reference

lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if UNLIKELY!result throwOutOfMemoryErrorexec, scope; return encodedJSValue; // The result can have an ArrayStorage indexing type if we're having a bad time. bool isArrayStorage =...

WebKit JSC - 'JSArray::appendMemcpy' Uninitialized Memory Copy

indexingType; if type == ArrayWithUndecided && copyType != NonArray if copyType == ArrayWithInt32 convertUndecidedToInt32vm; else if copyType == ArrayWithDouble convertUndecidedToDoublevm; else if copyType == ArrayWithContiguous convertUndecidedToContiguousvm; else ASSERTcopyType ==...

WebKit JSC - JSArray::appendMemcpy Uninitialized Memory Copy

WebKit JSC - JSArray::appendMemcpy Uninitialized Memory Copy indexingType; if type == ArrayWithUndecided && copyType != NonArray if copyType == ArrayWithInt32 convertUndecidedToInt32vm; else if copyType == ArrayWithDouble convertUndecidedToDoublevm; else if copyType == ArrayWithContiguous...

WebKit JSC Incorrect Scope Register Handling Vulnerability

WebKit suffers from a JSC incorrect scope register handling in DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry. WebKit: JSC: Incorrect scope register handling in DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry CVE-2017-7018 Here's a snippet of...

WebKit JSC ObjectPatternNode::appendEntry Use-After-Free Vulnerability

WebKit JSC suffers from an ObjectPatternNode::appendEntry stack use-after-free. WebKit: JSC: Stack-Use-After-Free in ObjectPatternNode::appendEntry Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNo...

WebKit WebCore::Node::getFlag Use-After-Free

WebKit: use-after-free in WebCore::Node::getFlag CVE-2017-7041 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC note that you might need to refresh a page a couple of times to trigger the bug:...

WebKit JSC JSArray::appendMemcpy Uninitialized Memory Copy Vulnerability

WebKit suffers from a JSC JSArray::appendMemcpy uninitialized memory copy vulnerability. WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy CVE-2017-7064 WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy Here's a snippet of JSArray::appendMemcpy. bool...

WebKit JSC arrayProtoFuncSplice Uninitiailzed Memory Reference Vulnerability

WebKit JSC suffers from an uninitialized memory reference in arrayProtoFuncSplice. WebKit: JSC: uninitialized memory reference in arrayProtoFuncSplice Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result =...

WebKit JSC Incorrect Scope Register Handling

WebKit: JSC: Incorrect scope register handling in DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry CVE-2017-7018 Here's a snippet of DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry. void flushInlineStackEntry inlineStackEntry ... if mgraph.needsScopeRegister...

WebKit WebCore::getCachedWrapper Use-After-Free

WebKit: use-after-free in WebCore::getCachedWrapper CVE-2017-7040 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar...

WebKit JSC - 'JSObject::putInlineSlow' / 'JSValue::putToPrimitive' Universal Cross-Site Scripting

let f = document.body.appendChilddocument.createElement'iframe'; let loc = f.contentWindow.location; f.onload = = let a = 1.2; a.proto.proto = f.contentWindow; a'test' = toString: function arguments.callee.caller.constructor'alertlocation'; ; ; f.src = 'data:text/html,' +...

WebKit JSC - 'ArgumentsEliminationPhase::transform' Incorrect LoadVarargs Handling

op == PhantomNewArrayWithSpread || candidate-op == PhantomSpread ... if argumentCountIncludingThis limit storeArgumentCountIncludingThisargumentCountIncludingThis; // store arguments ... node-remove; node-origin.exitOK = canExit; break; Whether or not the "argumentCountIncludingThis limit"...

Apple iTunes < 12.6.2 Multiple Vulnerabilities (credentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.6.2. It is, therefore, affected by multiple vulnerabilities : - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote...

WebKit JSC - JSObject::putInlineSlow JSValue::putToPrimitive Universal Cross-Site Scripting

WebKit JSC - JSObject::putInlineSlow JSValue::putToPrimitive Universal Cross-Site Scripting let f = document.body.appendChilddocument.createElement'iframe'; let loc = f.contentWindow.location; f.onload = = let a = 1.2; a.proto.proto = f.contentWindow; a'test' = toString: function...

WebKit JSC - ObjectPatternNode::appendEntry Stack Use-After-Free

WebKit JSC - ObjectPatternNode::appendEntry Stack Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1256 Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNode pattern,...