Search the Community
Showing results for tags 'ionmonkey'.
-
Exploits Spidermonkey IonMonkey Incorrect Prediction
1337day-Exploits posted a topic in Updated Exploits
Spidermonkey IonMonkey incorrectly predicts return type of Array.prototype.pop, leading to type confusion vulnerabilities. View the full article-
- spidermonkey
- ionmonkey
-
(and 2 more)
Tagged with:
-
Spidermonkey IonMonkey can, during a bailout, leak an internal JS_OPTIMIZED_OUT magic value to the running script. This magic value can then be used to achieve memory corruption. View the full article
-
- spidermonkey
- ionmonkey
-
(and 3 more)
Tagged with:
-
A bug in IonMonkey leaves type inference information inconsistent, which in turn allows the compilation of JITed functions that cause type confusions between arbitrary objects. View the full article
-
- spidermonkey
- ionmonkey
-
(and 2 more)
Tagged with:
-
A bug in IonMonkeys type inference system when JIT compiling and entering a constructor function via on-stack replacement (OSR) allows the compilation of JITed functions that cause type confusions between arbitrary objects. View the full article
-
- spidermonkey
- ionmonkey
-
(and 2 more)
Tagged with: