0day.today - 最大、世界でのデータベースを利用します。
- 私たちは一つのメインのドメインを使用します。http://0day.today
- 材料のほとんどは 完全に無料
- あなたがしたい場合は エクスプロイトを購入 / V.I.P.を取得アクセス または任意の他のサービスのために支払います、
あなたが購入したり、獲得する必要があります
金
ログイン このサイトの管理者が使用しています公式の連絡先.詐欺師にご注意！
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
お問い合わせ
次の方法でご連絡することができます:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Apple iMessage - DigitalTouch tap Message Processing Out-of-Bounds Read Exploit
[The digital touch iMessage extension can read out of bounds if a malformed Tap message contains a color array that is shorter than the points array and delta array. The method [ETTapMessage initWithArchiveData:] checks that the points array is twice as long as the deltas array, but only checks that the colors array is longer than eight bytes, even though a color is needed for every point-delta pair that is processed. To reproduce the issue with the files in tapcrash.zip: 1) install frida (pip3 install frida) 2) open sendMessage.py, and replace the sample receiver with the phone number or email of the target device 3) in injectMessage.js replace the marker "FULL PATH" with the path of the obj file 4) in the local directory, run: python3 sendMessage.py This will lead to a crash in SpringBoard requiring no user interaction. I've also attached a crash dump and ETencode.m, which is the file that was used to generate the obj file. Proof of Concept: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47158.zip # 0day.today [2024-07-01] #