---

[Message Precedent sur la mailing][Message Suivant sur la mailing][Precedent dans le fil][Prochain dans le fil][Index par Date][Index par fil] [SA32040] Mozilla Firefox "keypress" User Interface Event Dispatching Weakness

---

---

Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: link://[click]

TITLE: Mozilla Firefox "keypress" User Interface Event Dispatching Weakness

SECUNIA ADVISORY ID: SA32040

VERIFY ADVISORY: link://[click]

CRITICAL: Not critical

IMPACT: DoS

WHERE: From remote SOFTWARE: Mozilla Firefox 3.x link://[click]

DESCRIPTION: Aditya K Sood has discovered a weakness in Mozilla Firefox, which can be exploited by malicious people to cause a DoS (Denial of Service).

The weakness is caused due to an error when dispatching "keypress" user interface events with e.g. the HTML root element as target. This may potentially result in use of invalid memory or memory corruption via a specially crafted web page.

Successful exploitation crashes the browser. However, even though code execution has not been proven, it can't be completely ruled out.

The weakness is confirmed in version 3.0.3 for Windows. Version 2.x is not affected.

NOTE: Secunia normally does not classify a browser crash as a vulnerability nor issue an advisory about it. However, the potential impact of this issue may be more severe than currently believed.

SOLUTION: The weakness is fixed in the pre-release nightly builds of 3.1 and will be fixed in the upcoming version 3.0.4.

PROVIDED AND/OR DISCOVERED BY: Reported as a NULL-pointer dereference crash by Aditya K Sood.

Additional information provided by Secunia Research.



ORIGINAL ADVISORY: link://[click]

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: link://[click]

Definitions: (Criticality, Where etc.) link://[click]

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link.

Secunia NEVER sends attached files with advisories.

Secunia does not advise people to install third party patches, only use those supplied by the vendor.

---

• Precedent par Date: [SA32065] EC-CUBE Multiple Vulnerabilities
• Suivant par Date: [SA32064] Xen XenStore Domain Backend Configuration Weakness
• Precedent par fil : [SA32065] EC-CUBE Multiple Vulnerabilities
• Suivant par fil : [SA32064] Xen XenStore Domain Backend Configuration Weakness
• Index(s):
  • Date
  • Fil

---

Archives de la liste de diffusion Secunia
Archives de la liste de diffusion BugTraq
Archives de la liste de diffusion DailyDave
Archives de la liste de diffusion FunSec
Archives de la liste de diffusion Full Disclosure
Archives de la liste de diffusion Focus-IDS (FD)
Archives de la liste de diffusion Webappsec (FD)
Archives de la liste de diffusion Security-basics (FD)
Archives de la liste de diffusion Vulndiscuss
Archives de la liste de diffusion Vulnwatch