14092 matches found
WebKit JSC - DFG::ByteCodeParser::flush(InlineStackEntry* inlineStackEntry) Incorrect Scope Register Handling
WebKit JSC - DFG::ByteCodeParser::flushInlineStackEntry inlineStackEntry Incorrect Scope Register Handling scopeRegister; mcodeBlock| instead of |mcodeBlock|. But it doesn't. As a result, the scope register of |inlineStackEntry-mcodeBlock| may have an incorrect offset in the stack layout phase...
WebKit WebCore::RenderObject Use-After-Free
WebKit: use-after-free in WebCore::RenderObject with accessibility enabled CVE-2017-7046 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. O...
WebKit JSC JSObject::putInlineSlow / JSValue::putToPrimitive XSS Vulnerability
WebKit JSC JSObject::putInlineSlow and JSValue::putToPrimitive suffer from a universal cross site scripting vulnerability. WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive CVE-2017-7037 JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of...
WebKit WebCore::Node::nextSibling Use-After-Free
WebKit: use-after-free in WebCore::Node::nextSibling CVE-2017-7039 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar...
WebKit JSC JSArray::appendMemcpy Uninitialized Memory Copy
WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy CVE-2017-7064 WebKit: JSC: JSArray::appendMemcpy uninitialized memory copy Here's a snippet of JSArray::appendMemcpy. bool JSArray::appendMemcpyExecState exec, VM& vm, unsigned startIndex, JSC::JSArray otherArray auto scope =...
WebKit WebCore::AccessibilityRenderObject::handleAriaExpandedChanged Use-After-Free
WebKit: use-after-free in WebCore::AccessibilityRenderObject::handleAriaExpandedChanged CVE-2017-7043 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigge...
WebKit WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow
WebKit: heap-buffer-overflow in WebCore::RenderSearchField::addSearchResult CVE-2017-7049 There is a heap buffer overflow in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function go i.value = "1";...
Apple iOS < 10.3.3 Multiple Vulnerabilities
Binary data appleios1033check.nbin...
WebKit JSC - 'ObjectPatternNode::appendEntry' Stack Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1256 Here's a snippet of ObjectPatternNode::appendEntry. void appendEntryconst JSTokenLocation&, ExpressionNode propertyExpression, DestructuringPatternNode pattern, ExpressionNode defaultValue, BindingType bindingType...
WebKit JSC arrayProtoFuncSplice Uninitiailzed Memory Reference
WebKit: JSC: uninitialized memory reference in arrayProtoFuncSplice Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result = JSArray::tryCreateForInitializationPrivatevm,...
WebKit JSC ArgumentsEliminationPhase::transform Incorrect LoadVarargs Handling Vulnerability
WebKit JSC suffers from incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform. WebKit: JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform CVE-2017-7056 Here is a snippet of ArgumentsEliminationPhase::transform case LoadVarargs: ... if candidate-op ==...
WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free
WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free function go li.hidden = true; dir.setAttribute"aria-labeledby", "map"; !-- ================================================================= ASan log: =================================================================...
WebKit - WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow Exploit
Exploit for multiple platform in category dos / poc function go i.value = "1"; i.type = "search"; f.submit; ::buffer /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x8664+0x2694d46 1 0x116496bed in WTF::Vector::end...
WebKit - WebCore::getCachedWrapper Use-After-Free Exploit
Exploit for multiple platform in category dos / poc function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==29632==ERROR: AddressSanitizer: heap-use-after-free on...
WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free Exploit
Exploit for multiple platform in category dos / poc function go li.hidden = true; dir.setAttribute"aria-labeledby", "map"; !-- ================================================================= ASan log: ================================================================= ==728==ERROR:...
WebKit - 'WebCore::Node::getFlag' Use-After-Free
-webkit-flow-into: textarea; function freememory var a; forvar i=0;i foo !-- ================================================================= ASan log: ================================================================= ==29717==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000053b3...
WebKit - 'WebCore::AccessibilityNodeObject::textUnderElement' Use-After-Free
function go li.hidden = true; dir.setAttribute"aria-labeledby", "map"; !-- ================================================================= ASan log: ================================================================= ==728==ERROR: AddressSanitizer: heap-use-after-free on address 0x6080000908a0 at...
WebKit - 'WebCore::RenderObject' with Accessibility Enabled Use-After-Free
link text-transform: lowercase; link::first-letter border-spacing: 1em; function go dt.appendChildlink; var s = link.style; s.setProperty"display", "table-column-group"; s.setProperty"-webkit-appearance", "menulist-button"; function eventhandler dir.setAttribute"aria-labeledby", "meta";...
