Mozilla

mozilla

Mozilla Foundation Security Advisory 2010-44

Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish

Announced
July 20, 2010
Reporter
O. Andersen
Impact
Moderate
Products
Firefox, Thunderbird
Fixed in
  • Firefox 3.6.7
  • Thunderbird 3.1.1

Description

Security researcher O. Andersen reported that undefined positions within various 8 bit character encodings are mapped to the sequence U+FFFD which when displayed causes the immediately following character to disappear from the text run. This could potentially contribute to XSS problems on sites which expected extra characters to be present within strings being sanitized on the server.

References