Internet Exploiter 2 – bypassing DEP

In 2005 I released Internet Exploiter 2, which helped make heap spraying popular in browser exploits…

ALPHA3 released

I realized that if I would wait until I had fully documented everything in ALPHA3, it would probably never get released…

MS09-014: EMBED element memory corruption

Microsoft has just released a fix for an issue I reported to them on December 4th, 2008. A simple repro can be found here

MSIE screen[""] NULL ptr DoS details

MSIE can be made to crash with a NULL ptr Read AV by executing a very small piece of JavaScript. This affects MSIE 6.0, 7.0 and 8.0 beta2…

Safari arguments integer overflow PoC (CVE-2008-2303)

CVE-2008-2303 covers an integer overflow in the handling of indices in the “arguments” array in Apple Safari that affects iPhone, iPod and PC (Mac and Windows). It was fixed in Safari 3.2 for iPhone and iPod in July and for PC in November…