Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2008-66

Errors parsing URLs with leading whitespace and control characters

Announced
December 16, 2008
Reporter
Chip Salzenberg
Impact
Low
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 2.0.0.19
  • Firefox 3.0.5
  • SeaMonkey 1.1.14
  • Thunderbird 2.0.0.19

Description

Perl developer Chip Salzenberg reported that certain control characters, when placed at the beginning of a URL, would lead to incorrect parsing resulting in a malformed URL being output by the parser. IBM researchers Justin Schuh, Tom Cross, and Peter William also reported a related symptom as part of their research that resulted in MFSA 2008-37.

There was no direct security impact from this issue and its effect was limited to the improper rendering of hyperlinks containing specific characters. The severity of this issue was determined to be low.

References