lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 29 Dec 2015 23:52:58 +0200
From: "MustLive" <>
To: <>,
Subject: [FD] Vulnerabilities in Mobile Safari

Hello list!

There are multiple vulnerabilities in Mobile Safari. There are Denial of
Service and Cross-Site Scripting vulnerabilities.

In the middle of December I checked all exploits for different browsers,
which I published and non-published since 2006, in Mobile Safari for iOS
6.0.1 and 8.4.1. This is the first part of vulnerabilities.

Affected products:

Vulnerable are Mobile Safari 6.0.1 and 8.4.1 for iOS and previous versions.


Denial of Service (WASC-10):

Crash or freezing (with further crash) of the browser. -
in 6.0.1, and in 8.4.1 without crash, only consuming 60% CPU. - in
6.0.1. - in
6.0.1, and in 8.4.1 without crash, only consuming 60% CPU. - in
6.0.1, and in 8.4.1 without crash, only consuming 60% CPU.,%20IE,%20Opera%20&%20Chrome%20DoS%20Exploit.html -
in 6.0.1.

Made exploit for Mobile Safari, which is similar to 2008's exploit for 

Cross-Site Scripting (WASC-08):

Bypass XSS filters in Mobile Safari 6.0.1 and 8.4.1. The attack is possible
with using the next characters: 9 (0x09), 10 (0x0a), 12 (0x0c), 13 (0x0d),
32 (0x20), 47 (0x2f).

About it read my article Bypassing filters for conducting XSS attacks

I mentioned about these vulnerabilities at my site

Best wishes & regards,
Administrator of Websecurity web site 

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists