[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] Addendum : [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG)
- To: <cert@xxxxxxxx>, <info@xxxxxxxxxxxxx>, "full-disclosure" <full-disclosure@xxxxxxxxxxxxxxxxx>, <cve@xxxxxxxxx>, <nvd@xxxxxxxx>, <vuln@xxxxxxxxxxx>, "bugtraq" <bugtraq@xxxxxxxxxxxxxxxxx>, "Thierry Zoller" <Thierry@xxxxxxxxx>
- Subject: Re: [Full-disclosure] Addendum : [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG)
- From: "Jim Parkhurst" <JPARKHUR@xxxxxxxxxxxxxxx>
- Date: Wed, 27 May 2009 10:56:56 -0500
If I understand the process, saving the text at [IV. Proof of concept]
(following the "~~~..." to an .XHTML file, and launch the file using Firefox, I
should lose functionality ("Browser doesn't respond any longer to any user
input, all tabs are no longer accessible, your work if any (hail to the web
2.0) might be lost.")
Using FF2.0.0.20 and the file does not result in loss of use. All tabs are
functional. All JAVA links continue function. Same result for naming the POC
file to .HTML, .HTM.
>>> Thierry Zoller <Thierry@xxxxxxxxx> 05/26/2009 13:13 >>>
For those that failed to reproduce, try naming the POC file with an XHTML
extension.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/