Hello Bugtraq! I want to warn you about Denial of Service vulnerability in Mozilla Firefox, Internet Explorer and Chrome. At the end of December DoS vulnerability in Mozilla Firefox 3.0.5 was found by Jeremy Brown (http://websecurity.com.ua/2755/). After I checked at 23.12.2008 this vulnerability in different browsers (and also yesterday in new version of Firefox), I found that this Denial of Service vulnerability also exists in Firefox 3.0.13, Internet Explorer 6 and Chrome 1.0.154.48. DoS: Original exploit (http://www.milw0rm.com/exploits/7554). Use Google's cache because milw0rm.com is not working now (http://209.85.129.132/search?q=cache:aE09aeFDddMJ:www.milw0rm.com/exploits/7554+http://www.milw0rm.com/exploits/7554&cd=1&ct=clnk). With html file generated by this exploit in all affected browsers there is consuming of CPU resources (and some consuming of RAM resources, besides in those browsers, where there is no freeze, after closing of tab with exploit the memory is not released, so large amount of memory stays in use until closing of the browser). In Mozilla Firefox 3.0.5 and previous versions there is CPU Overload with freezing, at this in Firefox 3.0.13 there is only CPU Overload. In IE6 the exploit leads to CPU Overload with freezing. In Chrome 1.0.154.48 and previous versions the exploit leads to CPU Overload. But if to open empty tab and to close tab with the exploit, then on empty tab the browser can take 100% of CPU and freezes. Vulnerable version is Mozilla Firefox 3.0.13 and previous versions (and also must Firefox 3.5.x). Vulnerable version is Internet Explorer 6 (6.0.2900.2180) and previous versions. And potentially next versions (IE7 and IE8). Vulnerable version is Google Chrome 1.0.154.48 and previous versions (and potentially next versions). I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/3424/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua
