Apple Safari WebKit Security Bypass Vulnerability (CNVD-2017-01775)

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems.WebKit is a set of open source web browser engines developed by the KDE community. A security bypass vulnerability exists in Apple Safari WebKit handling page loads, whi...

Apple Safari WebKit Memory Corruption Vulnerability (CNVD-2017-01634)

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems.WebKit is a set of open source web browser engines developed by the KDE community. A memory corruption vulnerability exists in Apple Safari WebKit, which can be exploite...

Apple Safari WebKit memory corruption vulnerability (CNVD-2017-01685)

Apple Safari is an American web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. A memory corruption vulnerability exists in Apple Safari WebKit, which allows remote attackers to build malicious web pages that can be exploited to trick use...

Apple Safari WebKit Security Bypass Vulnerability (CNVD-2017-01776)

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems.WebKit is a set of open source web browser engines developed by the KDE community. A security bypass vulnerability exists in Apple Safari WebKit, which can be exploited ...

Apple Safari WebKit Memory Corruption Vulnerability (CNVD-2017-01636)

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. WebKit is a set of open source web browser engines developed by the KDE community. A memory corruption vulnerability exists in Apple Safari WebKit, which can be exploit...

Apple Safari WebKit Memory Corruption Vulnerability (CNVD-2017-01635)

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems.WebKit is a set of open source web browser engines. A memory corruption vulnerability exists in Apple Safari WebKit, which can be exploited by remote attackers to...

CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

Design/Logic Flaw

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

CVE-2016-9642

CVE-2016-9642 affects WebKit's JavaScriptCore in WebKitGTK+ (WebKitGTK+ up to version before 2.16.0) and WebKit/WebKitGTK+ deployments. The root cause is an out-of-bounds heap read triggered by a crafted Javascript file, leading to a denial of service. Public advisories (e.g., ASA-201704-9 for Ar...

CVE-2016-9642

Removed by vendor...

UBUNTU-CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

CVE-2016-9642

JavaScriptCore in WebKit allows attackers to cause a denial of service out-of-bounds heap read via a crafted Javascript file...

Apple WebKit - HTMLFormElement::reset() Use-After Free Exploit

Exploit for macOS platform in category dos / poc function go output.value = "aaa"; output.appendChildinserteddiv; document.getElementById"output".addEventListener'DOMSubtreeModified', function forvar i=0; i foo associatedElement downcastassociatedElement.reset; The issue is that while...

Apple WebKit - 'HTMLFormElement::reset()' Use-After Free

function go output.value = "aaa"; output.appendChildinserteddiv; document.getElementById"output".addEventListener'DOMSubtreeModified', function forvar i=0; i foo associatedElement downcastassociatedElement.reset; The issue is that while massociatedElements vector is being iterated, its content ca...

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled Exploit

Exploit for multiple platform in category dos / poc function boom m.append"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; m.setAttribute"aria-labeledby", "t"; d.open = false; foo firstChild; The function expects that the first child is going to be of type RenderBox, but in...

Apple WebKit HTMLKeygenElement Type Confusion

Apple WebKit: Type confusion in HTMLKeygenElement CVE-2017-2369 PoC: var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true; What happens here: 1. caretRangeFromPoint allows accessing...

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled

Apple WebKit - Type Confusion in RenderBox with Accessibility Enabled function boom m.append"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; m.setAttribute"aria-labeledby", "t"; d.open = false; foo firstChild; The function expects that the first child is going to be of type...

Apple WebKit - HTMLFormElement::reset() Use-After Free

Apple WebKit - HTMLFormElement::reset Use-After Free function go output.value = "aaa"; output.appendChildinserteddiv; document.getElementById"output".addEventListener'DOMSubtreeModified', function forvar i=0; i foo associatedElement downcastassociatedElement.reset; The issue is that while...