Apple WebKit Remote Code Execution Vulnerability

WebKit is KDE, Apple Apple, Google Google and other companies to develop a set of open source Web browser engine , currently used by Apple Safari and Google Chrome and other browsers . A remote code execution vulnerability exists in WebKit. A remote attacker could exploit this vulnerability to...

WebKit JSC - Heap Buffer Overflow in Intl.getCanonicalLocales Exploit

Exploit for multiple platform in category dos / poc arrayStorage; storage-msparseMap.clear; storage-mindexBias = 0; storage-mnumValuesInVector = 0; return butterfly; It allocates a fixed sizeBASEARRAYSTORAGEVECTORLEN of memory without caring about |initialLength|. So a BOF occurs in the following...

WebKit JSC - arrayProtoFuncSplice does not Initialize all Indices

WebKit JSC - arrayProtoFuncSplice does not Initialize all Indices lexicalGlobalObject-arrayStructureForIndexingTypeDuringAllocationArrayWithUndecided, actualDeleteCount; if !result return JSValue::encodethrowOutOfMemoryErrorexec, scope; for unsigned k = 0; k initializeIndexvm, k, v;...

WebKit JSC - JSGlobalObject::haveABadTime Causes Type Confusions

WebKit JSC - JSGlobalObject::haveABadTime Causes Type Confusions switchToSlowPutArrayStoragevm; = MINSPARSEARRAYINDEX || structurevm-holesMustForwardToPrototypevm return nullptr; Structure resultStructure = exec.l...

WebKit JSC - Intl.getCanonicalLocales Heap Buffer Overflow

WebKit JSC - Intl.getCanonicalLocales Heap Buffer Overflow arrayStorage; storage-msparseMap.clear; storage-mindexBias = 0; storage-mnumValuesInVector = 0; return butterfly; It allocates a fixed sizeBASEARRAYSTORAGEVECTORLEN of memory without caring about |initialLength|. So a BOF occurs in the...

WebKit JSC - 'Intl.getCanonicalLocales' Heap Buffer Overflow

arrayStorage; storage-msparseMap.clear; storage-mindexBias = 0; storage-mnumValuesInVector = 0; return butterfly; It allocates a fixed sizeBASEARRAYSTORAGEVECTORLEN of memory without caring about |initialLength|. So a BOF occurs in the following iteration. EncodedJSValue JSCHOSTCALL...

WebKit JSC Jit Optimization Check Failure

WebKit: JSC: JIT optimization check failed in IntegerCheckCombiningPhase::handleBlock CVE-2017-2547 When compiling Javascript code into machine code, bound checks for all accesses to a typed array are also inserted. These bound checks are re-optimized and the unnecessary checks are removed, which...

WebKit JSC arrayProtoFuncSplice Initialization Fail

WebKit: JSC: arrayProtoFuncSplice doesn't initialize all indices. CVE-2017-6980 Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result = JSArray::tryCreateForInitializationPrivatevm,...

WebKit JSC Intl.getCanonicalLocales Heap Buffer Overflow

WebKit: JSC: heap buffer overflow in Intl.getCanonicalLocales CVE-2017-6984 Here's tryCreateArrayButterfly which is invoked from intlObjectFuncGetCanonicalLocales to create a JSArray object. inline Butterfly tryCreateArrayButterflyVM& vm, JSCell intendedOwner, unsigned initialLength Butterfly...

WebKit JSC JSGlobalObject::haveABadTime Type Confusion

WebKit: JSC: JSGlobalObject::haveABadTime causes type confusions CVE-2017-7005 After JSGlobalObject::haveABadTime is called, the type of all JavaScript arraysincluding newly created arrays are of the same type: ArrayWithSlowPutArrayStorage. But of course this only affects objects that share the...

[SECURITY] Fedora 26 Update: chromium-58.0.3029.110-2.fc26

Chromium is an open-source web browser, powered by WebKit Blink...

WebKitGTK+: Multiple vulnerabilities

Background WebKitGTK+ is a full-featured port of the WebKit rendering engine. Description Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the CVE identifiers referenced below for details. Impact A remote attack can use multiple vectors to execute arbitrary code or cause...

How to use JavaScript array extensions integer overflow vulnerabilities in WebKit-a vulnerability warning-the black bar safety net

I will be in this article to tell you about the vulnerability, CVE-2017-2536/ZDI-17-358, which is a typical plastic overflow vulnerability, when the system is in the calculation of the allocated space size, the vulnerability will likely lead to a heap buffer overflow. We not only give you...

Important: Red Hat Security Advisory: chromium-browser security update

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

WebKit JSC emitPutDerivedConstructorToArrowFunctionContextScope Incorrect Check(CVE-2017-2531)

WebKit: JSC: incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope When a super expression is used in an arrow function, the following code, which generates bytecode, is called. if needsToUpdateArrowFunctionContext && !codeBlock-isArrowFunction bool canReuseLexicalEnvironment =...

WebKit: UXSS via CachedFrameBase::restore

This is similar to the case https://bugs.chromium.org/p/project-zero/issues/detail?id=1151. But this time, javascript handlers may be fired in FrameLoader::open. void FrameLoader::openCachedFrameBase& cachedFrame ... cleardocument, true, true, cachedFrame.isMainFrame; Click anywhere... function...

WebKit: UXSS: CachedFrame doesn't detach openers(CVE-2017-2528)

When a document loads "about:blank" or "about:srcdoc", it tries to inherit the security origin from its parent frame, or its opener frame if the parent frame doesn't exist. Normally, it doesn't happen that a subframe's document inherits its opener frame's security origin, because it has the paren...

WebKit: UXSS via Document::prepareForDestruction and CachedFrame

WebKit: UXSS via Document::prepareForDestruction and CachedFrame Here's a snippet of Document::prepareForDestruction void Document::prepareForDestruction if mhasPreparedForDestruction return; ... detachFromFrame; mhasPreparedForDestruction = true; Document::prepareForDestruction is called on the...

WebKit Unspecified Memory Corruption Vulnerability(CVE-2017-2521)

WebKit: JSC: JSObject::ensureLength doesn't check if ensureLengthSlow failed. Here's a snippet of JSObject::ensureLength. bool WARNUNUSEDRETURN ensureLengthVM& vm, unsigned length ASSERTlength vectorLength publicLength setPublicLengthlength; return result; |setPublicLength| is called whether...

WebKit: Element::setAttributeNodeNS UAF

WebKit: Element::setAttributeNodeNS UAF Here's a snippet of Element::setAttributeNodeNS. ExceptionOr Element::setAttributeNodeNSAttr& attrNode ... setAttributeInternalindex, attrNode.qualifiedName, attrNode.value, NotInSynchronizationOfLazyAttribute; attrNode.attachToElementthis;...