The Register: X-windows Remote DoS with Big Fonts

“X-windows [sic], with or without the font server (XFS)
running can be crashed remotely via Mozilla when fonts are set to
an unnaturally large size with CSS (Cascading Style Sheets), Tom
Vogt of Lemuira.org has reported.

“An X bug allows all available memory to be consumed, which
causes the system to freeze. The behavior can be duplicated with
applications like the Gimp, we’re told, but these aren’t remotely
exploitable. But with Mozilla, a pest can easily set up a malicious
Web site which will crash unsuspecting Tuxers’ boxen and cause any
unsaved data in open apps to go away.

“I’ve confirmed it on Mozilla 0.9.4 with XFree86 4.2.0. It takes
all of three seconds to immobilize a machine, and I was unable to
kill X or reboot from the keyboard. It affects all known versions
of Mozilla, numerous platforms, and is not limited to XF86…”

Complete
Story