seeing is believing
Showing 1 - 25 of 42 RSS Feed

Files from Ivan Fratric

Email addressprivate
First Active2007-03-08
Last Active2017-09-19
View User Profile
Microsoft Edge Partial Page Loading Memory Corruption
Posted Sep 19, 2017
Authored by Ivan Fratric, Google Security Research

There is a security issue in Microsoft Edge related to how HTML documents are loaded. If Edge displays a HTML document from a slow HTTP server, it is possible that a part of the document is going to be rendered before the server has finished sending the document. It is also possible that some JavaScript code is going to trigger. By making DOM modifications before the document had a chance of fully loading, followed by another set of DOM modifications after the page has been loaded, it is possible to trigger memory corruption that could possibly lead to an exploitable condition.

tags | exploit, web, javascript
advisories | CVE-2017-8731
MD5 | 38a51b456f8f99a75032e480ca87fb20
Microsoft Edge COptionsCollectionCacheItem::GetAt Out-Of-Bounds Read
Posted Sep 19, 2017
Authored by Ivan Fratric, Google Security Research

There is an out-of-bounds read issue in Microsoft Edge that could potentially be turned into remote code execution. The vulnerability has been confirmed on Microsoft Edge 38.14393.1066.0 (Microsoft EdgeHTML 14.14393) as well as Microsoft Edge 40.15063.0.0 (Microsoft EdgeHTML 15.15063).

tags | exploit, remote, code execution
advisories | CVE-2017-8734
MD5 | f8f0367a62a7c9dadd43f0e6c52c13e5
Microsoft Edge DuplicateHandle ACG Bypass
Posted Sep 15, 2017
Authored by Ivan Fratric, Google Security Research

ACG (Arbitrary Code Guard) in Microsoft Edge is bypassable. The bypass has been tested on Microsoft Edge 40.15063.0.0 running on Windows 10 Enterprise 64-bit with Creators Update (Version 1703, OS build 15063.413).

tags | exploit, arbitrary
systems | windows
MD5 | e55e370f65b1a357d3ec51c50261ae1c
Microsoft Chakra JIT Server Out-Of-Bounds Write
Posted Aug 16, 2017
Authored by Ivan Fratric, Google Security Research

The Microsoft Chakra JIT server suffers from an out-of-bounds write when processing a Js::OpCode::ProfiledLoopStart opcode.

tags | advisory
advisories | CVE-2017-8659
MD5 | c8362b5a1c7c3dbeb8acb12f5b8d33af
Microsoft Chakra JIT Server IRBuilder::Build Integer Overflow
Posted Aug 16, 2017
Authored by Ivan Fratric, Google Security Research

The Microsoft Chakra JIT server suffers from an integer overflow in IRBuilder::Build.

tags | advisory, overflow
advisories | CVE-2017-8637
MD5 | a4a8941cfa0b53cfa91df56147d65240
Microsoft Edge CInputDateTimeScrollerElement::_SelectValueInternal Out-Of-Bounds Read
Posted Aug 16, 2017
Authored by Ivan Fratric, Google Security Research

Microsoft Edge suffers from an out-of-bounds read in CInputDateTimeScrollerElement::_SelectValueInternal. The vulnerability has been confirmed on Windows 10 Enterprise 64-bit (OS version 1607, OS build 14393.1198) and Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393.

tags | exploit
systems | windows
advisories | CVE-2017-8644
MD5 | ae106588351f60c9e1078c6cf7ad219e
Microsoft Edge textarea.defaultValue Memory Disclosure
Posted Aug 10, 2017
Authored by Ivan Fratric, Google Security Research

There is a use-after-free vulnerability in Microsoft Edge that can lead to memory disclosure. The vulnerability has been confirmed on Windows 10 Enterprise 64-bit (OS version 1607, OS build 14393.1198), Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393.

tags | exploit
systems | windows
advisories | CVE-2017-8652
MD5 | 94db0de217892edc8b973671be6ef85b
WebKit WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow
Posted Jul 25, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a WebCore::RenderSearchField::addSearchResult heap buffer overflow vulnerability.

tags | exploit, overflow
advisories | CVE-2017-7049
MD5 | 04b54b4fde19de5e3ff97538dc8015b4
WebKit WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free
Posted Jul 25, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a WebCore::AccessibilityNodeObject::textUnderElement use-after-free vulnerability.

tags | exploit
advisories | CVE-2017-7048
MD5 | 84e9da66fe8fee86e5c1ebabf24d65cc
WebKit WebCore::RenderObject Use-After-Free
Posted Jul 25, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a use-after-free vulnerability in WebCore::RenderObject with accessibility enabled.

tags | exploit
advisories | CVE-2017-7046
MD5 | a4dea82325ce2ff7147bae6f3044af5b
WebKit WebCore::AccessibilityRenderObject::handleAriaExpandedChanged Use-After-Free
Posted Jul 25, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a WebCore::AccessibilityRenderObject::handleAriaExpandedChanged use-after-free vulnerability.

tags | exploit
advisories | CVE-2017-7043
MD5 | d5accb37ff0433ed20451be2bf8d0d2a
WebKit WebCore::InputType::element Use-After-Free
Posted Jul 25, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a WebCore::InputType::element use-after-free vulnerability.

tags | exploit
advisories | CVE-2017-7042
MD5 | 84bb52539cff54ae0d806d9a294724dc
WebKit WebCore::Node::getFlag Use-After-Free
Posted Jul 25, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a WebCore::Node::getFlag use-after-free vulnerability.

tags | exploit
advisories | CVE-2017-7041
MD5 | f406ef3e1b6958dc221da9cb7f623349
WebKit WebCore::getCachedWrapper Use-After-Free
Posted Jul 25, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a WebCore::getCachedWrapper use-after-free vulnerability.

tags | exploit
advisories | CVE-2017-7040
MD5 | 3a6a7d8569e29c1fb12610c995fbb00f
WebKit WebCore::Node::nextSibling Use-After-Free
Posted Jul 25, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a WebCore::Node::nextSibling use-after-free vulnerability.

tags | exploit
advisories | CVE-2017-7039
MD5 | c8f489da13b7b258afa1030ba904ea43
Microsoft Internet Explorer VBScript Type Confusion
Posted Jul 19, 2017
Authored by Ivan Fratric, Google Security Research

Microsoft Internet Explorer suffers from a VBScript arithmetic function type confusion vulnerability.

tags | exploit
MD5 | 36041e9339d744ded4732a8610849612
Microsoft Internet Explorer 11 CMarkup::DestroySplayTree Memory Corruption
Posted Jul 18, 2017
Authored by Ivan Fratric, Google Security Research

Microsoft Internet Explorer suffers from a memory corruption vulnerability in CMarkup::DestroySplayTree. The bug was confirmed on IE version 11.0.9600.18617 (Update version 11.0.40) running on Windows 7 64-bit.

tags | exploit
systems | windows, 7
advisories | CVE-2017-8594
MD5 | cdc2215843df74b066e451921f6fea5c
Microsoft Edge CssParser::RecordProperty Type Confusion
Posted Jun 24, 2017
Authored by Ivan Fratric, Google Security Research

Microsoft Edge suffers from a type confusion vulnerability in CssParser::RecordProperty.

tags | exploit
advisories | CVE-2017-8496
MD5 | f35998a34964e3e7b3233570554effa6
Mozilla Firefox ConvolvePixel Memory Disclosure
Posted May 25, 2017
Authored by Ivan Fratric, Google Security Research

Mozilla Firefox suffers from a memory disclosure vulnerability in ConvolvPixel. o.

tags | exploit
advisories | CVE-2017-5465
MD5 | 3a23a421f2f2d956bd6940d5351fc149
Mozilla Firefox gfxTextRun Out-Of-Bounds Read
Posted May 25, 2017
Authored by Ivan Fratric, Google Security Research

gfxTextRun in Mozilla Firefox suffers from a heap overflow vulnerability.

tags | exploit, overflow
advisories | CVE-2017-5447
MD5 | fe34c86a02e0524210d0853eb7bd51c5
Skia Graphics Library Heap Overflow
Posted May 25, 2017
Authored by Ivan Fratric, Google Security Research

Skia Graphic Library suffers from a heap overflow vulnerability.

tags | exploit, overflow
MD5 | c363fff3d5bebd39b9a724d2270d9ae9
Microsoft Internet Explorer CStyleSheetArray::BuildListOfMatchedRules Memory Corruption
Posted Apr 27, 2017
Authored by Ivan Fratric, Google Security Research

There is a memory corruption vulnerability in Microsoft Internet Explorer. The vulnerability was confirmed on version 11.576.14393.0 (update version 11.0.38) running on Windows 10 64-bit with page heap enabled for iexplore.exe process.

tags | exploit
systems | windows
advisories | CVE-2017-0202
MD5 | c84b10c1134ad272ca9b6c3a6c0ca2ff
WebKit WebCore::toJS Use-After-Free
Posted Apr 10, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a use-after-free vulnerability in WebCore::toJS.

tags | exploit
advisories | CVE-2017-2476
MD5 | f5d7f967b5751e9306026b2d038fc34f
WebKit Table Use-After-Free
Posted Apr 9, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a table related use-after-free vulnerability.

tags | exploit
advisories | CVE-2017-2471
MD5 | 5a26d622ce77f0bf4735a98fd4cfa0b5
WebKit ComposedTreeIterator::traverseNextInShadowTree Use-After-Free
Posted Apr 9, 2017
Authored by Ivan Fratric, Google Security Research

WebKit suffers from a use-after-free vulnerability in ComposedTreeIterator::traverseNextInShadowTree.

tags | exploit
advisories | CVE-2017-2466
MD5 | 1737a4d8cb967a6bce1249f482e6a3a6
Page 1 of 2
Back12Next

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    15 Files
  • 19
    Oct 19th
    10 Files
  • 20
    Oct 20th
    7 Files
  • 21
    Oct 21st
    4 Files
  • 22
    Oct 22nd
    2 Files
  • 23
    Oct 23rd
    10 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close