CVE-2017-1364
published 2017-10-03CVE-2017-1364: IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
PriorityP423medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
0.73%
49.9th percentile
IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126857.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Edge Chakra JIT - 'GlobOpt::OptTagChecks' Must Consider IsLoopPrePass Properly
exploitdb·2017-11-27
CVE-2017-11840 Microsoft Edge Chakra JIT - 'GlobOpt::OptTagChecks' Must Consider IsLoopPrePass Properly
Microsoft Edge Chakra JIT - 'GlobOpt::OptTagChecks' Must Consider IsLoopPrePass Properly
---
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1365
Some background: https://bugs.chromium.org/p/project-zero/issues/detail?id=1364
There's one more place that emits a BailOnNotObject opcode.
Here's a snippet of GlobOpt::OptTagChecks.
if (valueType.CanBeTaggedValue() &&
!valueType.HasBeenNumber() &&
(this->IsLoopPrePass() || !this->currentBlock->loop))
{
ValueType newValueType = valueType.SetCanBeTaggedValue(false);
// Split out the tag check as a separate instruction.
IR::Instr *bailOutInstr;
bailOutInstr = IR::BailOutInstr::New(Js::OpCode::BailOnNotObject, IR::BailOutOnTaggedValue, instr, instr->m_func);
...
}
The JIT compiler analyzes a loop twice for some reasons su
Exploit-DB
Microsoft Edge Chakra JIT - 'BailOutOnTaggedValue' Bailouts Type Confusion
exploitdb·2017-11-27
CVE-2017-11839 Microsoft Edge Chakra JIT - 'BailOutOnTaggedValue' Bailouts Type Confusion
Microsoft Edge Chakra JIT - 'BailOutOnTaggedValue' Bailouts Type Confusion
---
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1364
1.
In the Chakra's JIT compilation process, it stores variables' type information by basic block.
function opt(b) {
let o;
if (b) {
// BASIC BLOCK (a)
o = {};
} else {
// BASIC BLOCK (b)
o = 1.1;
}
// BASIC BLOCK (c)
return o;
}
For example, let's think the above code gets optimized. At the basic block (a), the type of "o" is always "Object". At the basic block (b), the type of "o" is always "CanBeTaggedValue_Float". At the basic block (c), it combines the two types, and marks the type of "o" as "CanBeTaggedValue_Mixed"(Object + CanBeTaggedValue_Float).
Explanation of TaggedValue in Chakra: http://abchatra.github.io/TaggedFloat/
But
No writeups or analysis indexed.
http://www.ibm.com/support/docview.wss?uid=swg22008785http://www.securityfocus.com/bid/101062https://exchange.xforce.ibmcloud.com/vulnerabilities/126857http://www.ibm.com/support/docview.wss?uid=swg22008785http://www.securityfocus.com/bid/101062https://exchange.xforce.ibmcloud.com/vulnerabilities/126857
2017-10-03
Published