full-disclosure - Firefox 0.92 DoS via TinyBMP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: sec at kaschwig.net (Thomas Kaschwig)
Subject: Firefox 0.92 DoS  via TinyBMP

Hi,

thE_iNviNciblE wrote:

> there is a security vulnerability in Firebox 0.92 (latest Version)
>
> http://www.4rman.com/exploits/tinybmp.htm
>
> this link causes that your virutal memory will be rise up 1,2 GB used
> Memory...

There is no such effect with Firefox 0.9.1 on Linux, the virtual memory 
for `fixefox-bin' goes only up to 76MB. It seems to be an Windows-only 
exploit.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040626 
Firefox/0.9.1

Thomas
-- 
PGP/GnuPG: http://www.kaschwig.net/kaschwig.gpg.asc * KeyID: 0x3D68D63A
Fingerprint: 274A 4CB8 B362 D593 39D6 0989 8FC3 725F 3D68 D63A