{"id":13544,"date":"2018-10-09T14:19:05","date_gmt":"2018-10-09T22:19:05","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2018\/10\/09\/news-7311\/"},"modified":"2018-10-09T14:19:05","modified_gmt":"2018-10-09T22:19:05","slug":"news-7311","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/10\/09\/news-7311\/","title":{"rendered":"SSD Advisory \u2013 Firefox Information Leak"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Tue, 09 Oct 2018 08:55:15 +0000<\/strong><\/p>\n

\n
\n

Vulnerabilities Summary<\/strong>
A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process.<\/p>\n

Vendor Response<\/strong>
“Security vulnerabilities fixed in Firefox 62.0.3 and Firefox ESR 60.2.2”<\/p>\n

CVE<\/strong>
CVE-2018-12387<\/p>\n

Credit<\/strong>
Independent security researchers, Bruno Keith and Niklas Baumstark, have reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
<\/span>
Affected systems<\/strong>
Firefox 62.0
Firefox ESR 60.2<\/p>\n

Vulnerability Details<\/strong>
While fuzzing Spidermonkey (Mozilla’s JavaScript engine written in C++), we trigger a debug assertion with the following minimized sample:<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n

JavaScript<\/span><\/div>\n<\/div>\n

<\/div>\n