Vulnerabilities in Mobile Safari

["MustLive" <mustlive () websecurity com ua>]

Hello list!

There are multiple Denial of Service vulnerabilities in Mobile Safari. After
conversation with Apple about all vulnerabilities in their browser during
December - February, I present the second advisory.

In the middle of December I checked all exploits for different browsers,
which I published and non-published since 2006, in Mobile Safari for iOS
6.0.1 and 8.4.1. This is the second part of vulnerabilities.

-------------------------
Affected products:
-------------------------

Vulnerable are Mobile Safari 6.0.1 and 8.4.1 for iOS and previous versions.

----------
Details:
----------

Denial of Service (WASC-10):

Crash or freezing (with further crash) of the browser.

http://websecurity.com.ua/uploads/2008/IE%20DoS%20Exploit5.html - in 6.0.1,
and in 8.4.1 without crash, only consuming 60% CPU.

http://websecurity.com.ua/uploads/2008/Mozilla,%20IE,%20Chrome%20&%20Opera%20DoS.html -
in 6.0.1, and in 8.4.1 without crash, only consuming 70% CPU.

http://websecurity.com.ua/uploads/2008/Mozilla,%20Opera%20&%20Chrome%20DoS%20Exploit.html -
in 6.0.1

http://websecurity.com.ua/uploads/2008/Opera%20DoS%20Exploit%20(freeze).html 
- in 6.0.1, and in 8.4.1 without crash, only consuming 60% CPU.

http://websecurity.com.ua/uploads/2008/Opera%20DoS%20Exploit.html - in
6.0.1, and in 8.4.1 without crash, only consuming 60% CPU.

http://websecurity.com.ua/uploads/2008/Opera%20DoS%20Exploit3.html - in
6.0.1, and in 8.4.1 without crash, only consuming 60% CPU.

http://websecurity.com.ua/uploads/2008/Opera%20DoS%20Exploit4.html - in
6.0.1, and in 8.4.1 without crash, only consuming 60% CPU.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/8154/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/