lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 21 Aug 2009 20:58:21 +0300
From: "MustLive" <>
To: <>
Subject: DoS vulnerabilities in Mozilla Firefox, Internet Explorer and Chrome

Hello Bugtraq!

I want to warn you about Denial of Service vulnerability in Mozilla Firefox,
Internet Explorer and Chrome.

At the end of December DoS vulnerability in Mozilla Firefox 3.0.5 was found
by Jeremy Brown ( After I checked at
23.12.2008 this vulnerability in different browsers (and also yesterday in
new version of Firefox), I found that this Denial of Service vulnerability
also exists in Firefox 3.0.13, Internet Explorer 6 and Chrome


Original exploit (

Use Google's cache because is not working now

With html file generated by this exploit in all affected browsers there is
consuming of CPU resources (and some consuming of RAM resources, besides in
those browsers, where there is no freeze, after closing of tab with exploit
the memory is not released, so large amount of memory stays in use until
closing of the browser).

In Mozilla Firefox 3.0.5 and previous versions there is CPU Overload with
freezing, at this in Firefox 3.0.13 there is only CPU Overload. In IE6 the
exploit leads to CPU Overload with freezing. In Chrome and
previous versions the exploit leads to CPU Overload. But if to open empty
tab and to close tab with the exploit, then on empty tab the browser can
take 100% of CPU and freezes.

Vulnerable version is Mozilla Firefox 3.0.13 and previous versions (and also
must Firefox 3.5.x).

Vulnerable version is Internet Explorer 6 (6.0.2900.2180) and previous
versions. And potentially next versions (IE7 and IE8).

Vulnerable version is Google Chrome and previous versions (and
potentially next versions).

I mentioned about these vulnerabilities at my site

Best wishes & regards,
Administrator of Websecurity web site

Powered by blists - more mailing lists