full-disclosure - Firefox 0.92 DoS via TinyBMP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: Thomas.Prock at Amadeus-IT.de (Prock Thomas)
Subject: Firefox 0.92 DoS via TinyBMP

Hi,
 
for me this works fine on a fully patched msie 6.0sp1 too. Firefox 0.8 doesn't seem to be vulnerable.
 
Greetz
 
>>Hi,
>>
>>there is a security vulnerability in Firebox 0.92 (latest Version)
>>
>>http://www.4rman.com/exploits/tinybmp.htm <http://www.4rman.com/exploits/tinybmp.htm> 
>>
>>this link causes that your virutal memory will be rise up 1,2 GB used
>>Memory...
>>
>>maybe Thunderbird 0.72 is also vulnerable via HTML.
>>
>>credits to: StupidWhiteMan
>>
>>--
>>   Best Regard thE_iNviNciblE
>>   ---------------------------
>>   Wissen ist Macht
>>
>>Freie Meinung: http://www.your-mind-is-free.de.vu <http://www.your-mind-is-free.de.vu> 
>>IT-Security  : http://www.kid2elite.de.vu <http://www.kid2elite.de.vu> 
>>IT-Forum     : http://www.security-focus.de.vu <http://www.security-focus.de.vu>