Comments on: Mozilla Firefox Security Bug Not Quite Fixed

By: Ryan

Ryan — Mon, 08 Jan 2007 17:15:25 +0000

I had completely forgotten about this, but the original bug has been fixed as the website says. My Firefox 2.0.0.1 didn’t crash on the first one that it mentions but the other one that it says hasn’t been fixed.

By: SLA

SLA — Mon, 08 Jan 2007 09:45:22 +0000

Still works with Firefox 2.0.1.

By: SLA

SLA — Wed, 25 Oct 2006 11:52:22 +0000

There is NO software which doesn’t need patching in the whole world. Every software needs to be patched sooner or later. This is absolutely normal. All humans’ creations are buggy

By: Hansen

Hansen — Wed, 25 Oct 2006 07:57:54 +0000

Hmmm, I don’t really know why, but surprisingly it didn’t crash my firefox v1.0.7 under Fedora Core 3!

By: netster007x

netster007x — Wed, 25 Oct 2006 05:27:26 +0000

I’ve got noscript as well, so to test the site I reluctantly temporarily enabled javascript and yup, crashed as advertised. This really surprises me, and I bet it’ll be fixed soon! Kinda sad, though, that this brand new release already needs patching.

Fx2

By: SLA

SLA — Tue, 24 Oct 2006 19:08:48 +0000

Firefox 3.0 alpha (20061011) – crashed in 1 second.
IE 7.0 Final Release – freezes for 5 minutes (eating 50% CPU, and RAM 135MB/5min), then I killed IE7 process.
Opera 9.02 – resisted successfully (with about 30 seconds “wait” mouse pointer).

I’m sure that Mozilla team will fix this VERY soon, and what about Microsoft team? We will have to wait 1 year until IE7 SP1, or 5 years until IE8 ?

By: Ajay

Ajay — Tue, 24 Oct 2006 18:43:42 +0000

Crashed IE7 as well.

By: Lewis

Lewis — Tue, 24 Oct 2006 18:38:03 +0000

Crashes MSIE 6 for me.

By: Bill

Bill — Tue, 24 Oct 2006 18:28:53 +0000

Wrong bug.

The bug causing the crash you see here is at:
[bugzilla.mozilla.org]

It is still in a new state with no clear path of how to fix it. As I read this, it isn’t the claimed security hole that the Security Advisory page talks about.

This doesn’t cause any memory corruption, just a stack overflow and the application immediately aborts.

from the comments on the bug:
——- Comment #13 From Robert O’Callahan (Novell) 2006-09-11 21:26 PDT [reply] ——-

There is no way to fix this without breaking very deeply nested pages …
except by rewriting Gecko to avoid the use of recursion. That would take a
while.

——- Comment #14 From Robert O’Callahan (Novell) 2006-09-11 21:27 PDT [reply] ——-

I think limiting the depth allowed by the XML parser, just like the HTML parser
does, would be a good start.

By: Ryan

Ryan — Tue, 24 Oct 2006 17:40:21 +0000

Dave wrote:

javascript required

so once again, the noscript extension comes in handy

Thanks Dave…I forgot to mention that but I added it to the post.

Nate The Great wrote:

That link even pretty much crashed IE7. after it loads it wont respond. ctrl alt delete saves the day again!

I tried it in IE7 and even though it did run a little sluggish I was still able to close the tab and have it return to normal without restarting the browser.