Mozilla Firefox Range script denial of service vulnerability

Firefox's Range object in the air there is quoted indicator problem, the success of the attacks take advantage of this loophole may lead to the collapse of the browser.

 

Systems affected:

Mozilla Firefox <= 1.5.0.7

Mozilla Firefox 2.0

Description:

Firefox is an open-source browser WEB.

Firefox's Range object in the air there is quoted indicator problem, the success of the attacks take advantage of this loophole may lead to the collapse of the browser.

SelectNode method can be used to initialize the object Range choose to be injected in the Range node, you can create documents using createContextualFragment debris, as follows:

var tagString = "I am a div node";
var range = document.createRange ();
range.selectNode (document.getElementsByTagName ( "div"). item (0));
var documentFragment = range.createContextualFragment (tagString);
document.body.appendChild (documentFragment);

CreateRange document shows that the use of a range of ways to create, and then the current document some of the elements used to initialize the scope of selectNode way. Then you can use to create createContextualFragment can be injected into the document file fragments. SelectNode to send DOCUMENT_TYPE_NODE (
<* Source: Carlos Barros (barros@barrossecurity.com)

Manufacturers patch: Mozilla

At present, manufacturers have not provided a patch or upgrade process, we propose to use this software, users concerned about the vendor's home page at any time to obtain the latest version:

http://www.mozilla.org/

powered by performancing firefox