PT-2005-5385 · Mozilla · Firefox

Tom Ferris · Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4720

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 1.0.7 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in a client crash. This is achieved through an IFRAME element with a large value of the WIDTH attribute. The large value triggers a problem related to the representation of floating-point numbers, leading to an infinite loop of widget resizes and a corresponding large number of function calls on the stack.

Recommendations For Mozilla Firefox versions 1.0.7 and earlier, consider avoiding the use of large values for the WIDTH attribute in IFRAME elements until a fix is available. As a temporary workaround, restricting the use of IFRAME elements with large WIDTH attribute values may help minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-4720

DSA-1044-1

Affected Products

Firefox

References · 8

• 🔥 http://security-protocols.com/advisory/sp-x19-advisory.txt · Exploit
• 🔥 http://securityfocus.com/bid/15015 · Exploit
• 🔥 http://security-protocols.com/modules.php?name=News&file=article&sid=2978 · Exploit
• 🔥 https://exploit-db.com/exploits/26325 · Exploit
• 🔥 http://securitytracker.com/id?1015011 · Exploit
• http://secunia.com/advisories/17071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4720 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=303433 · Note