You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2012-101

Mozilla Foundation Security Advisory 2012-101

Title: Improper character decoding in HZ-GB-2312 charset
Impact: High
Announced: November 20, 2012
Reporter: Masato Kinugawa
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 17.0
  Firefox ESR 10.0.11
  Thunderbird 17.0
  Thunderbird ESR 10.0.11
  SeaMonkey 2.14

Description

Security researcher Masato Kinugawa found when HZ-GB-2312 charset encoding is used for text, the "~" character will destroy another character near the chunk delimiter. This can lead to a cross-site scripting (XSS) attack in pages encoded in HZ-GB-2312.

References