PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Patch Analysis of MS16–063 (jscript9.dll)

theori.io | research | #exploit | #memory-corruption | #patch-analysis | #internet-explorer | #ms16-063 | #jscript9
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A patch-analysis deep dive into MS16-063: diffing jscript9.dll to locate a TypedArray/DataView memory-corruption bug, then rebuilding it into a working proof-of-concept exploit for Internet Explorer.
Published
Collected

Related coverage

vulnerability · theori.io
Patch Analysis of CVE-2016–0189
Diffing MS16-051 to dissect CVE-2016-0189, the Internet Explorer scripting-engine flaw used in South Korean targeted attacks: a missing SafeArray lock plus a policy bypass, rebuilt into a PoC exploit.
vulnerability · blog.quarkslab.com
Analysis of MS16-104: .URL files Security Feature Bypass (CVE-2016-3353)
CVE-2016-3353, a .URL file security feature bypass in IE 11 fixed by MS16-104: binary diffing ieframe.dll to locate the patch, understanding the InternetShortcut warning logic, and building a PoC.
research · theori.io
Chakra JIT CFG Bypass
Bypassing Windows' Control Flow Guard in IE and Edge by abusing Chakra JIT: trigger compilation, locate the native code buffer, modify and run — a technique later fixed in MS16-119.
research · depthfirst.com
Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities
We chained two memory-safety flaws in Oj, a native Ruby JSON parser used by GitLab's notebook diff renderer, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.
research · swarm.ptsecurity.com
The Click that shouldn’t have worked: RCE via clickjacking in Internet Explorer
Though IE reached end of life in 2020, its engine powers the WebBrowser control in many VB/.NET/C# apps; PT SWARM details vulnerabilities found there, culminating in RCE achieved via clickjacking.
research · depthfirst.com
NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability
depthfirst's system found four remote memory-corruption bugs in NGINX, including a 2008-era heap overflow (CVE-2026-42945); a PoC shows RCE with ASLR off. rewrite/set users are at risk.
Back