User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729) Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729) The vulnerability is caused when a user open a web with many "<a>" tags and the "content type" of the web server is "text/xml. After it, firefox only crash... nothing more. Reproducible: Always Steps to Reproduce: 1.Start the malicious webserver 2.Open the web site with firefox Actual Results: The browser crash, nothing more! Expected Results: firefox should display a classic error of xml caused for a invalid string but not a crash. Talking about security: i do some test, for example in windows always crash on xul module in a null memory address and for this reason i say that maybe is only a (dos,stack exhaustion,null pointer) however, if there are a security issue is on linux, because we know that a null pointer is exploitable but i can't control the memory address... LINUX : libxul.so WIN : xul.dll

This web server written in python is for test the vulnerability! you only need give the port number!.

looks like a dupe of bug 485941