html.exploit.cve_2016_7201-1

[jcscott2015]

I haven't seen this reported in a search of issues, but your compat-table site seems to be infected or at least vulnerable to the html.exploit.cve_2016_7201-1. This exploit affects Windows users. I'm on a Mac using ClamXAV, and the exploit always pops up when visiting https://kangax.github.io/compat-table/es6/. This is likely a server issue.

[chicoxyzzy]

It's because of Flattr and / or other 3rd-party scripts.

@kangax could we remove some of them?

[ljharb]

Can you link to the exploit? What's the issue?

[kangax]

Yeah, I don't mind removing them if that's the issue. But shouldn't it be reported to Flattr then? I'm also unclear on how exactly they're affected?

[chicoxyzzy]

Exploit description https://nvd.nist.gov/vuln/detail/CVE-2016-7201

Actually it seems that the problem with memory corruption could be on our side. @jcscott2015 please more info if that's possible.

[ljharb]

The exploit tho is in Edge, not in our JS; Edge users have an action item here, but why do we?

[chicoxyzzy]

IMO we can fix problem on our side too if it's easy enough

[ljharb]

There's nothing to fix tho ; the vulnerability is Edge users who visit a malicious website. We aren't one, and neither is Flattr, and those users should update their Edge anyways. Am I reading this CVE wrong?

[jcscott2015]

@chicoxyzzy I don't have much to add. I usually use Chrome Version 62.0.3202.94 (Official Build) (64-bit) on Mac, but Safari triggers the same infection alert. On page load, Chrome dumps a small file (247 kb) into the ClamXAV quarantine folder, while Safari dumps the whole web page (4.3 mgs).

I'm not having any memory issues with cache -- nothing in the logs. There's definitely a payload. I've attached a ZIP of one of the Chrome files.

f_00295b.zip