Mozilla Foundation Security Advisory 2008-66
Errors parsing URLs with leading whitespace and control characters
- Announced
- December 16, 2008
- Reporter
- Chip Salzenberg
- Impact
- Low
- Products
- Firefox, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 2.0.0.19
- Firefox 3.0.5
- SeaMonkey 1.1.14
- Thunderbird 2.0.0.19
Description
Perl developer Chip Salzenberg reported that certain control characters, when placed at the beginning of a URL, would lead to incorrect parsing resulting in a malformed URL being output by the parser. IBM researchers Justin Schuh, Tom Cross, and Peter William also reported a related symptom as part of their research that resulted in MFSA 2008-37.
There was no direct security impact from this issue and its effect was limited to the improper rendering of hyperlinks containing specific characters. The severity of this issue was determined to be low.