| To: | bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk |
|---|---|
| Subject: | Re: [Full-disclosure] Firefox onUnload + document.write() memory corruption vulnerability (MSIE7 null ptr) |
| From: | Daniel Veditz <dveditz@cruzio.com> |
| Date: | Sun, 25 Feb 2007 08:32:08 -0800 |
| Cc: | security@mozilla.org |
| Delivered-to: | sp-com-lists@consult.net |
| Delivered-to: | bugtraq-list@securepoint.com |
| Delivered-to: | mailing list bugtraq@securityfocus.com |
| Delivered-to: | moderator for bugtraq@securityfocus.com |
| In-reply-to: | <Pine.LNX.4.58.0702230229090.21707@dione> |
| List-help: | <mailto:bugtraq-help@securityfocus.com> |
| List-id: | <bugtraq.list-id.securityfocus.com> |
| List-post: | <mailto:bugtraq@securityfocus.com> |
| List-subscribe: | <mailto:bugtraq-subscribe@securityfocus.com> |
| List-unsubscribe: | <mailto:bugtraq-unsubscribe@securityfocus.com> |
| Mailing-list: | contact bugtraq-help@securityfocus.com; run by ezmlm |
| References: | <Pine.LNX.4.58.0702230229090.21707@dione> |
| User-agent: | Thunderbird 1.5.0.10pre (Windows/20070224) |
Michal Zalewski wrote: > A quick test case that crashes while trying to follow partly > user-dependent corrupted pointers near valid memory regions (can be forced > to write, too): > > http://lcamtuf.coredump.cx/ietrap/testme.html > > Firefox problem is being tracked here: > https://bugzilla.mozilla.org/show_bug.cgi?id=371321 This bug was fixed in 2.0.0.2, released Friday Feb 23. |
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | JBrowser Acces to Admin Panel Exploit, crazy_king |
|---|---|
| Next by Date: | [ GLSA 200702-10 ] UFO2000: Multiple vulnerabilities, Raphael Marichez |
| Previous by Thread: | Firefox onUnload + document.write() memory corruption vulnerability (MSIE7 null ptr), Michal Zalewski |
| Next by Thread: | Re: [Full-disclosure] Firefox onUnload + document.write() memory corruption vulnerability (MSIE7 null ptr), Stan Bubrouski |
| Indexes: | [Date] [Thread] [Top] [All Lists] |