Bugtraq mailing list archives
Re: Re[2]: Update: [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG)
From: Nick Boyce <nick.boyce () gmail com>
Date: Wed, 15 Jul 2009 16:54:01 +0100
On Tue, Jul 14, 2009 at 3:27 PM, Thierry Zoller<Thierry () zoller lu> wrote:
NB> Thierry says he thinks No, but you say /something/ nasty happened to NB> your FF 3.5, if I understand you correctly. It affects 3.5, there was no effective patch included in that version.
For the record (and again I hope I'm not wasting your time by misunderstanding the problem), I can report that FF 3.5 (en-GB version) running on Win2K SP4+ (Workstation), with the extensions Noscript, Oldbar, JRE6, and British dictionary, is unaffected by the PoC for TZO-26-2009 that you published here in May [1]. No CPU slugging, no disk activity, browser stays fully responsive, along with rest of system. But nor do I see any red circle generated by the HTML :) I could guess from some statements on the web ([3]) that FF's SVG doesn't work on Windows 2000 at all, except that I have no problem viewing this : http://upload.wikimedia.org/wikipedia/en/a/a9/Barack_Obama_Hope_poster.svg At the end of Mozilla bug 393832 [2] (of which your own bug 465615 was a duplicate) there is a comment dated 13.July.2009 stating a patch for the SVGLength code was added, but I downloaded my FF 3.5 on 9.July, so that can't be relevant. Curious ... I would have thought this one would be OS-agnostic. [1] http://seclists.org/bugtraq/2009/May/0249.html [2] https://bugzilla.mozilla.org/show_bug.cgi?id=393832#c14 [3] http://www.mozilla.org/projects/svg/build.html (last paragraph) Cheers, Nick Boyce -- "A week in the lab saves an hour in the library"
Current thread:
- Update: [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) Thierry Zoller (Jul 10)
- <Possible follow-ups>
- Re: Update: [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) Neil Dickey (Jul 13)
- Re: Update: [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) Nick Boyce (Jul 14)
- Re[2]: Update: [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) Thierry Zoller (Jul 14)
- Re: Re[2]: Update: [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) Nick Boyce (Jul 15)
- Re: Update: [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG) Nick Boyce (Jul 14)