Home page logo
/

bugtraq logo Bugtraq mailing list archives

Firefox Remote Code Execution and DoS 1.5.0.2
From: chris () splices org
Date: 24 Apr 2006 01:26:37 -0000

---------------------------------------------------
Software:  
 Firefox Web Browser
Tested: 
 Linux, Windows clients' version 1.5.0.2
Result:  
 Firefox Remote Code Execution and Denial of Service - Vendor contacted, no patch yet.
Problem:
 A handling issue exists in how Firefox handles certain Javascript in js320.dll and xpcom_core.dll
regarding iframe.contentWindow.focus().  By manipulating this feature a buffer overflow will occur.  
Proof of Concept:
 http://www.securident.com/vuln/ff.txt
Credits:
 splices(splices [dot] org)
 spiffomatic64(spiffomatic64 [dot] com)
 Securident Technologies (securident [dot] com)      
------------------------------------------------


  By Date           By Thread  

Current thread:
  • Firefox Remote Code Execution and DoS 1.5.0.2 chris (Apr 24)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]