741757 - Reported Crash / vulnerability

Status: REOPENED

(Core :: DOM: Core & HTML, defect, P5)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Attachment: Exploit Supplied by Reporter

Message from reporter:
=======================
From: George G <[e-mail]>
Subject: URGENT
Date: April 1, 2012 4:41:22 PM PDT
Hi,
I'm contacting you because I've found a vulnerability o Mozilla Firefox browser.
I did two exploits in Javascript, they're related with denial of service. One of the exploit just show down the home page.
The other is really powerfull, it close the browser and show a message saying that firefox crashed to restart the browser again.


I am contacting you because would like know if you're the right person to try make a deal about this and talk about details.
If yes I can send you all the details after we get a deal.


Let me know something ASAP,
Kind Regards!

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I got a non-exploitable OOM crash with the testcase.

Comment 3

[Benjamin Smedberg]

Indeed:
0 	mozalloc.dll 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:79
1 	mozalloc.dll 	mozalloc_handle_oom 	memory/mozalloc/mozalloc_oom.cpp:60
2 	mozalloc.dll 	moz_xrealloc 	memory/mozalloc/mozalloc.cpp:137
3 	xul.dll 	nsGenericDOMDataNode::SetTextInternal

This should be opened up and marked with whatever the current equivalent of sg:dos is.

Comment 4

[Scoobidiver (away)]

Dupe of bug 741090?

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats.  Other resolutions may be appropriate for other reasons.

(Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes.  The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.