full-disclosure - Re: Firefox <= 2.0 crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4546B9BD.7050404@security-protocols.com>
Date: Mon, 30 Oct 2006 18:49:33 -0800
From: tommy <tommy@...urity-protocols.com>
To: Matthew Flaschen <matthew.flaschen@...ech.edu>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Firefox <= 2.0 crash

You can test it out here if you want:

http://security-protocols.com/poc/ff2_death.html

Here is what I get on OS X with the latest build of ff2

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000004
0x001ea16b in nsParser::ParseFragment ()
(gdb) bt
#0  0x001ea16b in nsParser::ParseFragment ()
#1  0x00101748 in nsRange::CreateContextualFragment ()
#2  0x0185d98d in XPTC_InvokeByIndex ()
#3  0x0038ccfb in XPCWrappedNative::CallMethod ()

-- Tom

Matthew Flaschen wrote:
> Maybe I'm copying it out wrong.  Seems unlikely, but can someone who got 
> it to "work" (crash) upload it somewhere for a more standardized test?
>
> Matt Flaschen
>
> Ozan Ozkara wrote:
>   
>> it works perfect on linux 
>>
>> On Mon, 2006-10-30 at 11:38 -0500, Matthew Flaschen wrote:
>>     
>>> Nothing happens when I load it in Firefox 2.0 on Windows XP.
>>>
>>> Matthew Flaschen
>>>
>>> Carlos Barros wrote:
>>>       
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>     
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>   

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/