CVEvulnerability
CVE-2009-5017
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-11-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.
Affected configurations
• mozilla firefox (<= 3.6)
• mozilla firefox 3.6
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://hg.mozilla.org/releases/mozilla-1.9.2/rev/e42c563313a0 hg.mozilla.org
- http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html Exploit
- https://bugzilla.mozilla.org/show_bug.cgi?id=511859 Patch
- https://bugzilla.mozilla.org/show_bug.cgi?id=522634 bugzilla.mozilla.org
- http://hg.mozilla.org/releases/mozilla-1.9.2/rev/e42c563313a0 hg.mozilla.org
- http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html Exploit
- https://bugzilla.mozilla.org/show_bug.cgi?id=511859 Patch
- https://bugzilla.mozilla.org/show_bug.cgi?id=522634 bugzilla.mozilla.org