Service workers and base URIs

Previously when we've run into a contentious service worker design issue, we've asked web developers what they think. This has worked out pretty well in the past, with developer feedback directly informing spec changes. It's also great because we can blame y'all if you pick the wrong thing. Well,...

Apache Httpd < 2.4.20 : mod_http2: denial of service by thread starvation

By manipulating the flow control windows on streams, a client was able to block server threads for long times, causing starvation of worker threads. Connections could still be opened, but no streams where processed for these. This issue affected HTTP/2 support in 2.4.17 and 2.4.18...

Debian DLA-404-1 : nginx security update

It was discovered that there was a invalid pointer deference in nginx, a small, powerful, scalable web/proxy server. An invalid pointer dereference might occur during DNS server response processing, allowing an attacker who is able to forge UDP packets from the DNS server to cause worker process...

nginx -- multiple vulnerabilities

Maxim Dounin reports: Several problems in nginx resolver were identified, which might allow an attacker to cause worker process crash, or might have potential other impact if the "resolver" directive is used in a configuration file...

Linux Kernel prima WLAN Driver Heap Overflow

/ Coder: Shawn the R0ck, [email protected] Co-worker: Pray3r, [email protected] Compile: arm-linux-androideabi-gcc wextpoc.c --sysroot=$SYSROOT -pie ./a.out wlan0 Boom......shit happens as always;- / include include include include include include include include typedef unsigned char vU8t; defin...

Mozilla: Mixed content WebSocket policy bypass through workers (MFSA 2015-132)

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, which allows remote attackers to bypass intended mixed-content restrictions via crafted JavaScript code...

Mozilla Firefox and Firefox mixed-content restriction bypass vulnerability

Mozilla Firefox is an open source web browser.Firefox ESR is an extended support version of Firefox. Mozilla Firefox incorrectly uses a web worker to create WebSocket objects, which allows remote attackers to bypass mixed-content restrictions and gain unauthorized access using specially crafted...

Code injection

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, which allows remote attackers to bypass intended mixed-content restrictions via crafted JavaScript code...

CVE-2015-7197

CVE-2015-7197 affects Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, where a web worker can instantiate a WebSocket object, bypassing mixed-content restrictions via crafted JavaScript. Connected sources confirm the description and show remediation paths (update Firefox to 42.0+ or ...

Mozilla: Mixed content WebSocket policy bypass through workers (MFSA 2015-132)

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, which allows remote attackers to bypass intended mixed-content restrictions via crafted JavaScript code...

Breaching a bank in 20 minutes - Horror Stories 2015

I arrived onsite to suite 102 the banks corporate headquarters around 9:40 a.m. I was impersonating a local utility worker - with all the garments like a hardhat, clipboard, obnoxious yellow vest, and some old Timberland work boots. I played the part well...

Google Chrome ServiceWorker Memory Misreference Vulnerability

Google Chrome is an open source WEB browser. Google Chrome contains a memory misreference vulnerability in the content/browser/serviceworker/embeddedworkerinstance.cc file in the ServiceWorker implementation that allows attackers to construct malicious WEB pages that can be tricked into parsing t...

chromium-browser: Use-after-free in ServiceWorker

Use-after-free vulnerability in content/browser/serviceworker/embeddedworkerinstance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a...

UBUNTU-CVE-2015-6757

Use-after-free vulnerability in content/browser/serviceworker/embeddedworkerinstance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a...

Mozilla Firefox 'WorkerPrivate::NotifyFeatures' Function Competition Condition Vulnerability

Mozilla Firefox is an open source web browser. A competitive condition vulnerability in the Mozilla Firefox 'WorkerPrivate::NotifyFeatures' function allows remote attackers to exploit incorrect interactions between shared worker and IndexedDB implementations to crash the application or execute...

Use-after-free with shared workers and IndexedDB — Mozilla

Security researcher Looben Yang discovered a use-after-free vulnerability when using a shared worker with IndexedDB due to a race condition with the worker. This results in a potentially exploitable crash that can be triggered through web content...

The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions.

The vulnerability of the NavigatorServiceWorker::serviceWorker function in the Blink component of Google Chrome is related to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions when using...

Google Chrome Blink Same-Origin Policy Bypass Vulnerability (CNVD-2015-05805)

Google Chrome is a WEB-based browser. A vulnerability in the modules/serviceworkers/NavigatorServiceWorker.cpp NavigatorServiceWorker::serviceWorker function in Google Chrome Blink allows remote attackers to construct a malicious WEB page that can trick the user to parse it, which can bypass the...

802.11 Massive Monitoring: WiWo

wiwo is a distributed 802.11 monitoring and injecting system that was designed to be simple and scalable, in which all workers nodes can be managed by a Python framework Building the worker Requirements Install necessary requirements. $ sudo apt-get install build-essential git subversion...

CVE-2015-1292

The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker...