[CVE-2016-9079] The Great DOM Fuzz-off of 2017

A JIT miscompilation reaches arbitrary code execution in the Firefox content process and also affects Tor Browser, underscoring the residual risk in heavily audited JavaScript engines.

Gareth Heyes bypassed Firefox's HTML Sanitizer API: SVG 'use' elements importing same-origin absolute URLs still executed JavaScript, even for uploads protected with Content-Disposition: attachment.

Gareth Heyes applies behavioural fuzzing to Firefox's HTML and JavaScript parsers, uncovering quirks like alternative HTML comment terminations that can aid XSS filter bypasses.

By James Forshaw, Project Zero In my previous blog post I discussed an issue with the Windows Kernel’s handling of Restricted Tokens which allowed me to escape the Chrome GPU sandbox. Originally I’d planned to use Firefox for the proof-of-concept as Firefox uses the same effective sandbox level as the Chrome GPU process for its content renderers. That means a FF content RCE would give code execution in a sandbox where you could abuse the Windows Kernel Restricted Tokens issue, making it much more serious.

A guest post describing CVE-2017-7308, a signedness bug in Linux packet sockets leading to a heap out-of-bounds write and local privilege escalation, found via syzkaller.

A Google Project Zero write-up exploiting CVE-2015-0318, a bug in the PCRE regular expression engine as used in Adobe Flash.