Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Internet Explorer EPM Sandbox Escape CVE-2014-6350

projectzero.google | vulnerability | CVE-2014-6350 | #sandbox-escape | #windows | #exploitation | #project-zero | #internet-explorer | #cve-2014-6350

Summary

A Google Project Zero post detailing exploitation of CVE-2014-6350 to escape Internet Explorer's Enhanced Protected Mode sandbox.
CVE
CVE-2014-6350
Published
Collected

original ↗

Related coverage

blog · projectzero.google
In-Console-Able
A Google Project Zero post describing a Windows security bug that weakens sandbox-style restrictions and could aid sandbox escape research.
vulnerability · projectzero.google
[CVE-2015-4481] Between a Rock and a Hard Link
Hard links are legal inside Windows sandboxes, making them a useful exploitation primitive; the post weighs their pros and cons and demonstrates them in the real vulnerability CVE-2015-4481.
blog · projectzero.google
Dude, where’s my heap?
A Google Project Zero post examining heap spraying and heap address randomization, and how browser exploits can still succeed against them.
vulnerability · projectzero.google
(^Exploiting)\s*(CVE-2015-0318)\s*(in)\s*(Flash$)
A Google Project Zero write-up exploiting CVE-2015-0318, a bug in the PCRE regular expression engine as used in Adobe Flash.
blog · projectzero.google
Attacking the Windows NVIDIA Driver
A Project Zero post on attacking NVIDIA's Windows kernel graphics driver, covering several of the 16 vulnerabilities found during this GPU attack surface research.
blog · projectzero.google
A Shadow of our Former Self
An exploration of Windows symbolic link mitigations, presenting a technique introduced in Windows 8 that restores part of the symbolic link capability available to sandboxed processes.
back