Closed
Bug 68322
Opened 24 years ago
Closed 24 years ago
Crasher & possible exploit in dispatchEvent
Categories
(Core :: DOM: UI Events & Focus Handling, defect)
Core
DOM: UI Events & Focus Handling
Tracking
()
People
(Reporter: security-bugs, Assigned: joki)
Details
Attachments
(2 files)
I was looking for something other but discovered that dispatchEvent (???) may
lead to jumping (setting EIP) or accessing
strange memory locations. In all cases Mozilla crashes but with different
exceptions.
The memory location seems to depend on the events that are dispatched - I could
not program them (because
document.createEvent seems to be broken).
After examining the registers/memory after several crashes I believe this should
be fixed because it may become exploitable.
Test the 2 attached html files for demos.
Georgi Guninski
|
Reporter | |
Comment 1•24 years ago
|
||
|
|
Reporter | |
Comment 2•24 years ago
|
||
|
Assignee | |
Comment 3•24 years ago
|
||
Dupe but I'll look into the security aspect when I fix it.
*** This bug has been marked as a duplicate of 61022 ***
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → DUPLICATE
|
||
Updated•23 years ago
|
QA Contact: madhur → rakeshmishra
|
||
Updated•22 years ago
|
QA Contact: rakeshmishra → trix
|
||
Updated•6 years ago
|
Component: Event Handling → User events and focus handling
You need to log in
before you can comment on or make changes to this bug.
Description
•