The Register: X-windows Remote DoS with Big Fonts

"X-windows [sic], with or without the font server (XFS) running can be crashed remotely via Mozilla when fonts are set to an unnaturally large size with CSS (Cascading Style Sheets), Tom Vogt of Lemuira.org has reported.

"An X bug allows all available memory to be consumed, which causes the system to freeze. The behavior can be duplicated with applications like the Gimp, we're told, but these aren't remotely exploitable. But with Mozilla, a pest can easily set up a malicious Web site which will crash unsuspecting Tuxers' boxen and cause any unsaved data in open apps to go away.

"I've confirmed it on Mozilla 0.9.4 with XFree86 4.2.0. It takes all of three seconds to immobilize a machine, and I was unable to kill X or reboot from the keyboard. It affects all known versions of Mozilla, numerous platforms, and is not limited to XF86..."

Complete Story

Related Stories:

• Red Hat Linux Advisory: Mozilla(May 15, 2002)
• MozillaNews.org: Mozilla.org Clarifies Security Policy (May 07, 2002)
• ZDNet UK: Netscape Flaw Exposes Hard Drives(May 01, 2002)
• Bugtraq: Mozilla Cookie Exploit(Jan 24, 2002)