CVE-2010-1939
Apple Safari 4.0.5 - Use-After-Free via Popup Window Close Method
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-1939. PoCs published by Alexey Sintsov, Krystian Kloskowski.
AI-analyzed exploit summary This exploit leverages a JIT-spray technique to bypass DEP and ASLR in Safari, using a chain of HTML files to trigger a vulnerability via parent.close(). The shellcode executes 'notepad' as a demonstration.
Description
Use-after-free vulnerability in Apple Safari 4.0.5 on Windows allows remote attackers to execute arbitrary code by using window.open to create a popup window for a crafted HTML document, and then calling the parent window's close method, which triggers improper handling of a deleted window object.
Exploits (2)
This exploit leverages a JIT-spray technique to bypass DEP and ASLR in Safari, using a chain of HTML files to trigger a vulnerability via parent.close(). The shellcode executes 'notepad' as a demonstration.
This exploit targets a memory corruption vulnerability in Apple Safari 4.0.5 via the parent.close() function. It uses a heap spray technique to achieve arbitrary code execution, demonstrated by launching calc.exe.