Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2011-47

Potential XSS against sites using Shift-JIS

Announced
November 8, 2011
Reporter
Yosuke Hasegawa
Impact
High
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 3.6.24
  • Firefox 8
  • SeaMonkey 2.5
  • Thunderbird 3.1.16
  • Thunderbird 8

Description

Yosuke Hasegawa reported that the Mozilla browser engine mishandled invalid sequences in the Shift-JIS encoding. When encountering an invalid pair Mozilla would turn the entire two-byte sequence into a single unknown character rather than an unknown character followed by a valid single-byte character. On some sites attackers may have been able to end their input with the first byte of a two byte sequence; when that input was later put into a page context it might cause the following delimiter (such as a double-quote) to be consumed, breaking the format of the page. Depending on the page this could potentially be used to steal data or inject script into the page.

References