 |
|
|
|
The newest version of Flock browser is affected to so-called concurrency-related XML handler memory corruption vulnerability disclosed on Bugtraq recently.
When visiting the test link http://lcamtuf.coredump.cx/ffoxdie3.html
browser crashed after a delay of some seconds. No user interaction was needed.
Affected versions:
Vulnerability has been confirmed in Flock 0.7.4.1 in Windows 2000 SP4 fully patched.
UA string: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.5) Gecko/20060731 Firefox/1.5.0.5 Flock/0.7.4.1
Solution status:
No updated version available from the vendor at the time of reporting.
Vendor Homepage:
http://www.flock.com/
Credit:
This vulnerability was reported earlier in Firefox 1.5.0.6 by Michal Zalewski.
Juha-Matti Laurio confirmed this vulnerability in Flock.
This message provides some additional information to previous message related to K-Meleon browser.
Timeline:
18-Aug-2006 - Vulnerability confirmed in Flock
19-Aug-2006 - Security companies and several CERT units contacted
Best regards,
Juha-Matti Laurio
Networksecurity.fi
http://www.networksecurity.fi/
|
|
|
|
|
|
|
|
