Ubuntu
firefox package

Dos problem with marquee tag

Bug #47751 reported by Vincenzo Ampolo on 2006-05-31

	Status	Importance	Assigned to
Mozilla Firefox	Invalid	Critical	mozilla-bugs #239840
firefox (Ubuntu)	Won't Fix	Medium	Unassigned
firefox-3.0 (Ubuntu)	Won't Fix	Medium	Unassigned

Bug Description

Hi,
as also reported on securityfocus at http://www.securityfocus.com/archive/1/435373/30/0/threaded using this kind of html page:

<html>

<head>

<title>Credit to n00b..</title>

</head>

<body>

</body>

</html>

Firefox uses all the cpu resources and it becames not usable.
I've tested it in ubuntu dapper (upgraded from flight 6) on amd64 (firefox is at version 1.5.0.3)

See original description

Tags:

CVE References

Revision history for this message

In Mozilla Bugzilla #239840, Greg Campbell (glc-bugs) wrote on 2004-04-07:

confirmed
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040402
Firefox/0.8.0+

Revision history for this message

In Mozilla Bugzilla #239840, Martijn-martijn (martijn-martijn) wrote on 2004-05-20:

Created attachment 148963
Attached testcase

Same testcase as mentioned before.

It hangs on my computer too, but when I have javascript turned off, it doesn't
hang.

Revision history for this message

In Mozilla Bugzilla #239840, Martijn-martijn (martijn-martijn) wrote on 2004-05-20:

I see this also in Mozilla1.7RC2

Revision history for this message

In Mozilla Bugzilla #239840, basic (basic) wrote on 2004-10-28:

with a recent moz cvs trunk build all I see Javascript errors about too much
recursion, no "hang". fixed?

Revision history for this message

In Mozilla Bugzilla #239840, basic (basic) wrote on 2004-10-28:

ok spoke too soon, will investigate

Revision history for this message

In Mozilla Bugzilla #239840, basic (basic) wrote on 2004-10-28:

a slightly different testcase from bug 265027
https://bugzilla.mozilla.org/attachment.cgi?id=162508&action=view

no <dl>s just <marquee>s with huge height attributes.

Revision history for this message

In Mozilla Bugzilla #239840, Bernd (bernd-mozilla) wrote on 2005-04-04:

I split the marquee hang from comment 6 into bug 288931 as it is very different

Revision history for this message

In Mozilla Bugzilla #239840, Martijn-martijn (martijn-martijn) wrote on 2006-03-01:

Ok, with current trunk build it doesn't hang anymore, it's just slow.
With Mozilla1.7, I hang, so something has definetely improved since then.

Revision history for this message

In Mozilla Bugzilla #239840, nitro322 (nitro-legroom) wrote on 2006-05-30:

This is still an issue, confirmed with Firefox 1.5.0.3. Also, this issue has been posted to BugTraq (which is where I learned of it), so visibility is likely to soon rise.

A fix would really be a good thing.

Revision history for this message

In Mozilla Bugzilla #239840, Raisemachine (raisemachine) wrote on 2006-05-31:

#10

Confirmed with Bon Echo using BugTraq example.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1a3) Gecko/20060530 BonEcho/2.0a3

Revision history for this message

In Mozilla Bugzilla #239840, Raisemachine (raisemachine) wrote on 2006-05-31:

#11

Created attachment 223870
BugTraq Testcase

Should have attached this to my last post.

Revision history for this message

In Mozilla Bugzilla #239840, Mccpat (mccpat) wrote on 2006-05-31:

#12

Confirmed using testcase on WinXP SP1 w/ FF 1.5.0.3. I saw this on BugTraq, also. I'm surprised this hasn't been fixed yet...

Revision history for this message

Vincenzo Ampolo (vincenzo-ampolo) wrote on 2006-05-31:

#13

Hi,
as also reported on securityfocus at http://www.securityfocus.com/archive/1/435373/30/0/threaded using this kind of html page:

<html>

<head>

<title>Credit to n00b..</title>

</head>

<body>

</body>

</html>

Firefox uses all the cpu resources and it becames not usable.
I've tested it in ubuntu dapper (upgraded from flight 6) on amd64 (firefox is at version 1.5.0.3)

Revision history for this message

In Mozilla Bugzilla #239840, Dveditz (dveditz) wrote on 2006-06-02:

#14

*** Bug 339954 has been marked as a duplicate of this bug. ***

Revision history for this message

In Mozilla Bugzilla #239840, Brad-berkemier (brad-berkemier) wrote on 2006-06-02:

#15

Using BugTraq test case.

Confirmed in:

Firefox Current Release -
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

Mozilla Latest Nightly -
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050702

WFM in:

Firefox Latest Trunk Nightly -
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060601 Minefield/3.0a1

Seems to be fixed in the trunk.

Revision history for this message

In Mozilla Bugzilla #239840, Mccpat (mccpat) wrote on 2006-06-04:

#16

Confirmed for me in 1.5.0.4, WinXP/SP1.

Revision history for this message

In Mozilla Bugzilla #239840, Robert Ames (ramses0) wrote on 2006-06-06:

#17

fixing up title for searching (added nested, de-emphasizing DL tags), indicating relation to Bug #339954 .

Original title: "hang when many <dl> and <marquee> tags are used. exponential time increase depending on number of <dl> tags.."

New title: "hang when many nested <marquee> tags are used. exponential time increase"

Revision history for this message

In Mozilla Bugzilla #239840, Robert Ames (ramses0) wrote on 2006-06-06:

#18

*** Bug 339954 has been marked as a duplicate of this bug. ***

Revision history for this message

In Mozilla Bugzilla #239840, Jruderman (jruderman) wrote on 2006-08-13:

#19

Dup of bug 277208? (Which is fixed on trunk, btw)

Revision history for this message

In Mozilla Bugzilla #239840, David Farning (dfarning) wrote on 2006-12-13:

#20

Can confirm that the first Attached testcase still hangs 2.0.

David

Revision history for this message

David Farning (dfarning) wrote on 2006-12-13:

#21

I still get this behavior as of firefox 2.0. Critical bug open upstream.

David

Changed in firefox:
status:	Unconfirmed → Confirmed

Revision history for this message

In Mozilla Bugzilla #239840, Ryanvm (ryanvm) wrote on 2006-12-13:

#22

Was there anything in this bug to make you think it was fixed for 2.0?
https://bugzilla.mozilla.org/page.cgi?id=etiquette.html

Revision history for this message

In Mozilla Bugzilla #239840, Ryanvm (ryanvm) wrote on 2006-12-13:

#23

(In reply to comment #18)
> Dup of bug 277208? (Which is fixed on trunk, btw)
>

Definitely not. Testcase still kills the trunk.

Revision history for this message

In Mozilla Bugzilla #239840, Martijn-martijn (martijn-martijn) wrote on 2006-12-13:

#24

(In reply to comment #21)
> Definitely not. Testcase still kills the trunk.

Oops, yes, it is now crashing current trunk builds, this is something new, I filed bug 363722 for it. This bug is for the hanging issue (which may return after bug 363722 gets fixed).

Bug Watch Updater (bug-watch-updater) on 2006-12-14

Changed in firefox:
status:	Unknown → Confirmed

Revision history for this message

In Mozilla Bugzilla #239840, Kees Cook (kees) wrote on 2007-02-07:

#25

This seems to have been assigned a CVE, though not specific to firefox: CVE-2006-6954

Revision history for this message

Alexander Sack (asac) wrote on 2007-02-19:

#26

confirmed upstream bug is 'In Progress' for us.

Changed in firefox:
assignee:	nobody → mozillateam
status:	Confirmed → In Progress

David Farning (dfarning) on 2007-02-24

Changed in firefox:
assignee:	mozillateam → mozilla-bugs

Revision history for this message

In Mozilla Bugzilla #239840, Fernando Hartmann (matafagafo-yahoo) wrote on 2007-03-30:

#27

There are another example (exploit) on the following link

http://milw0rm.com/exploits/3606

The marquee tags are placed before the head tag.

Revision history for this message

In Mozilla Bugzilla #239840, Dveditz (dveditz) wrote on 2007-04-03:

#28

... and earlier http://milw0rm.com/exploits/1867

CVE-2006-2723 is more appropriate, -6954 seems to be the Flock variant of the same thing.

Revision history for this message

In Mozilla Bugzilla #239840, Tanis-altralogica (tanis-altralogica) wrote on 2008-01-31:

#29

It still happens quite frequently for me when opening certain myspace.com profiles. (with v2.0.0.11)

Revision history for this message

In Mozilla Bugzilla #239840, Ryanvm (ryanvm) wrote on 2008-01-31:

#30

Thanks for the report, but please consider the Bugzilla etiquette guidelines before posting more "me too" comments in the future so that developers can more easily see the relevant information in a bug and so that people CCed to a bug (like myself) aren't needlessly spammed.
https://bugzilla.mozilla.org/page.cgi?id=etiquette.html

Revision history for this message

In Mozilla Bugzilla #239840, Vseerror (vseerror) wrote on 2008-02-28:

#31

*** Bug 338474 has been marked as a duplicate of this bug. ***

Revision history for this message

In Mozilla Bugzilla #239840, Jan-pieniadz (jan-pieniadz) wrote on 2008-05-06:

#32

*** Bug 432199 has been marked as a duplicate of this bug. ***

Alexander Sack (asac) on 2008-10-31

Changed in firefox:
assignee:	mozilla-bugs → nobody
status:	In Progress → Triaged
Changed in firefox-3.0:
importance:	Undecided → Medium
status:	New → Triaged

Revision history for this message

John Vivirito (gnomefreak) wrote on 2009-03-10:

#33

This wont be fixed in firefox 2
I'm closing other firefox task due to neither this bug nor upstream have not been updated since 2007 and 2008
2008 is more than a year ago

Changed in firefox:
status:	Triaged → Won't Fix
Changed in firefox-3.0:
status:	Triaged → Won't Fix

Bug Watch Updater (bug-watch-updater) on 2010-09-17

Changed in firefox:
importance:	Unknown → Critical

Bug Watch Updater (bug-watch-updater) on 2018-05-25

Changed in firefox:
status:	Confirmed → Unknown

Bug Watch Updater (bug-watch-updater) on 2018-05-30

Changed in firefox:
status:	Unknown → Confirmed

Revision history for this message

In Mozilla Bugzilla #239840, Mozilla-kaply (mozilla-kaply) wrote on 2021-01-12:

#34

This doesn't happen with our new Marquee implementation.

Revision history for this message

In Mozilla Bugzilla #239840, Fbraun-k (fbraun-k) wrote on 2021-01-12:

#35

This was fixed via bug 1425874.

Bug Watch Updater (bug-watch-updater) on 2021-01-13

Changed in firefox:
status:	Confirmed → Invalid

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

mozilla-bugs #239840
[RESOLVED WORKSFORME] Edit

Bug watches keep track of this bug in other bug trackers.

Ubuntufirefox package

Dos problem with marquee tag

Bug Description

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
firefox package