This Metasploit module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the embed element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850). The type confusion can be used as addrof and fakeobj primitives that then lead to arbitrary read/write of memory. These primitives allow us to write shellcode into a JIT region (RWX memory) containing the next stage of the exploit. The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server, and extracts a macOS application containing our payload into /var/db/CVMS. The payload can then be opened with CVE-2020-9801, executing the payload as a user but without sandbox restrictions.
fbbde1e0b4f53036aee6e135d84e5add073f53c612d6996cee132e6170926d16Debian Linux Security Advisory 4724-1 - Vulnerabilities have been discovered in the webkit2gtk web engine.
bd01e21fee93c77a5566719ae8099d9a3183292c9d4c3d2f3005eeab1df925ccGentoo Linux Security Advisory 202007-11 - Multiple vulnerabilities have been found in WebKitGTK+, the worst of which could result in the arbitrary execution of code. Versions less than 2.28.3 are affected.
99e0943f5aa94b86ce4b4675b90f8ea67f1e87e239b56bf6ebe7c3e9b1269186Apple Security Advisory 2020-05-26-10 - iCloud for Windows 7.19 is now available and addresses code execution, cross site scripting, denial of service, out of bounds read, and out of bounds write vulnerabilities.
62db8b0b76c4b9282432d70396fd37bb8568c629f4d9e8835ed1b611ab0d95bbApple Security Advisory 2020-05-26-9 - iCloud for Windows 11.2 is now available and addresses code execution, cross site scripting, denial of service, out of bounds read, and out of bounds write vulnerabilities.
100cbea4dc7f344692f604cbe8dfab29c51a9e753f7d0e6e5204c16baf6f0880Apple Security Advisory 2020-05-26-8 - iTunes 12.10.7 for Windows addresses code execution, cross site scripting, denial of service, out of bounds read, and out of bounds write vulnerabilities.
b54c3b2604ae9bd59edb7cbd324ad1bc43d253eca37d86dbc127855a7ba085f2Apple Security Advisory 2020-05-26-7 - Safari 13.1.1 is now available and addresses code execution and cross site scripting vulnerabilities.
8b7dce5d32dceb835cd62c85f176c7a87bd99a3dbad33629c6c8dd27534b2540
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed