Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2010-44

Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish

Announced
July 20, 2010
Reporter
O. Andersen
Impact
Moderate
Products
Firefox, Thunderbird
Fixed in
  • Firefox 3.6.7
  • Thunderbird 3.1.1

Description

Security researcher O. Andersen reported that undefined positions within various 8 bit character encodings are mapped to the sequence U+FFFD which when displayed causes the immediately following character to disappear from the text run. This could potentially contribute to XSS problems on sites which expected extra characters to be present within strings being sanitized on the server.

References