Mozilla

Mozilla

Mozilla Foundation Security Advisory 2012-24

Potential XSS via multibyte content processing errors

Announced
April 24, 2012
Reporter
Anne van Kesteren
Impact
High
Products
Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR
Fixed in
  • Firefox 12
  • Firefox ESR 10.0.4
  • SeaMonkey 2.9
  • Thunderbird 12
  • Thunderbird ESR 10.0.4

Description

Anne van Kesteren of Opera Software found a multi-octet encoding issue where certain octets will destroy the following octets in the processing of some multibyte character sets. This can leave users vulnerable to cross-site scripting (XSS) attacks on maliciously crafted web pages.

References