You are here: Known Vulnerabilities in Mozilla Products (Firefox 1.0.7) > MFSA 2005-57

Mozilla Foundation Security Advisory 2005-57

Title: IDN heap overrun using soft-hyphens
Severity: Critical
Reporter: Tom Ferris
Products: Firefox, Mozilla Suite

Fixed in: Firefox 1.0.7
  Mozilla Suite 1.7.12

Description

Tom Ferris reported a Firefox crash when processing a domain name consisting solely of soft-hyphen characters. This is due to a heap overrun triggered when Internationalized Domain Name (IDN) processing results in an empty string after removing non-mapping characters such as soft-hyphens. This overrun could be exploited to run or install malware on a user's computer.

Mozilla Thunderbird does not process IDN host names and is thus not affected by this vulnerability.

Workaround

Disable IDN. Instructions on how to do so manually or through a small patch can be found here. Installing the fixed versions will restore IDN functionality if you've installed the patch; if you disabled IDN manually it will have to be reenabled the same way.

References