PT-2005-5385 · Mozilla · Firefox

Tom Ferris · Publicado 2005-12-31 · Atualizado 2008-09-05 · CVE-2005-4720

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 1.0.7 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in a client crash. This is achieved through an IFRAME element with a large value of the WIDTH attribute. The large value triggers a problem related to the representation of floating-point numbers, leading to an infinite loop of widget resizes and a corresponding large number of function calls on the stack.

Recommendations For Mozilla Firefox versions 1.0.7 and earlier, consider avoiding the use of large values for the WIDTH attribute in IFRAME elements until a fix is available. As a temporary workaround, restricting the use of IFRAME elements with large WIDTH attribute values may help minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-4720

DSA-1044-1

Produtos afetados

Firefox

Referências · 8

• 🔥 http://security-protocols.com/advisory/sp-x19-advisory.txt · Exploit
• 🔥 http://securityfocus.com/bid/15015 · Exploit
• 🔥 http://security-protocols.com/modules.php?name=News&file=article&sid=2978 · Exploit
• 🔥 https://exploit-db.com/exploits/26325 · Exploit
• 🔥 http://securitytracker.com/id?1015011 · Exploit
• http://secunia.com/advisories/17071 · Aviso do Fabricante
• https://bugzilla.mozilla.org/show_bug.cgi?id=303433 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4720 · Nota de Segurança