You are currently viewing a snapshot of www.mozilla.org taken on April 21, 2008. Most of this content is highly out of date (some pages haven't been updated since the project began in 1998) and exists for historical purposes only. If there are any pages on this archive site that you think should be added back to www.mozilla.org, please file a bug.



You are here: Known Vulnerabilities in Mozilla Products (Firefox 2.0.0.12) > MFSA 2008-13

Mozilla Foundation Security Advisory 2008-13

Title: Multiple XSS vulnerabilities from character encoding
Impact: Moderate
Announced: March 25, 2008
Reporter: Alexey Proskuryakov, Yosuke Hasegawa, Simon Montagu
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 2.0.0.12
  Thunderbird 2.0.0.12
  SeaMonkey 1.1.8

Description

WebKit developer Alexey Proskuryakov reported that the Mozilla HTML parser treated the backspace character as whitespace contrary to the HTML specification and different from other browsers. This difference might lead to Cross-site Scripting (XSS) risks on sites which filtered input in accordance with the specification.

Yosuke Hasegawa reported a flaw in the way Mozilla parses the control character 0x80 under Shift_JIS encoding. This flaw could potentially be used to evade web-site input filters and result in a XSS attack hazard. While investigating, Mozilla developer Simon Montagu discovered several variants of this flaw involving zero-length non-ASCII sequences in ISO-2022-JP, ISO-2022-CN, ISO-2022-KR, and HZ-GB-2312.

These flaws were fixed in and prior to Firefox 2.0.0.12 but the announcement was held until other browser vendors could fix related flaws.

Workaround

Disable JavaScript until a version containing these fixes can be installed. Although the flaw is in the parser, the main risk is using these flaws to construct a XSS attack which requires scripting to be enabled.

References