CVE-2005-2871
NoneCVSS
—
EPSS
21.1%
Published
Sep 9, 2005
CISA due date
—
The record
Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all "soft" hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:3.0 | mozilla | 0 | No fix |
| Debian:3.1 | mozilla | 0 | 1:1.7.8-1sarge3 |
| Debian:3.1 | mozilla-firefox | 0 | 1.0.4-2sarge4 |
| Debian:3.1 | mozilla-thunderbird | 0 | 1.0.2-2.sarge1.0.7 |
| Red Hat:enterprise_linux:4::as | firefox | 0 | 0:1.0.6-1.4.2 |
| Red Hat:enterprise_linux:4::as | firefox-debuginfo | 0 | 0:1.0.6-1.4.2 |
| Red Hat:enterprise_linux:4::as | thunderbird | 0 | 0:1.0.7-1.4.1 |
| Red Hat:enterprise_linux:4::as | thunderbird-debuginfo | 0 | 0:1.0.7-1.4.1 |
| Red Hat:enterprise_linux:4::desktop | firefox | 0 | 0:1.0.6-1.4.2 |
| Red Hat:enterprise_linux:4::desktop | firefox-debuginfo | 0 | 0:1.0.6-1.4.2 |
| Red Hat:enterprise_linux:4::desktop | thunderbird | 0 | 0:1.0.7-1.4.1 |
| Red Hat:enterprise_linux:4::desktop | thunderbird-debuginfo | 0 | 0:1.0.7-1.4.1 |
| Red Hat:enterprise_linux:4::es | firefox | 0 | 0:1.0.6-1.4.2 |
| Red Hat:enterprise_linux:4::es | firefox-debuginfo | 0 | 0:1.0.6-1.4.2 |
| Red Hat:enterprise_linux:4::es | thunderbird | 0 | 0:1.0.7-1.4.1 |
| Red Hat:enterprise_linux:4::es | thunderbird-debuginfo | 0 | 0:1.0.7-1.4.1 |
| Red Hat:enterprise_linux:4::ws | firefox | 0 | 0:1.0.6-1.4.2 |
| Red Hat:enterprise_linux:4::ws | firefox-debuginfo | 0 | 0:1.0.6-1.4.2 |
| Red Hat:enterprise_linux:4::ws | thunderbird | 0 | 0:1.0.7-1.4.1 |
| Red Hat:enterprise_linux:4::ws | thunderbird-debuginfo | 0 | 0:1.0.7-1.4.1 |
Related vulnerabilities
- CVE-2006-1993 Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a… Also affects mozilla
- CVE-2006-1730 Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before… Also affects mozilla
- CVE-2006-0749 nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before… Also affects mozilla
- CVE-2005-4134 Mozilla Firefox 1.5, Netscape 8.0.4 and 7.2, and K-Meleon before 0.9.12 allows remote… Also affects mozilla
- CVE-2005-2265 Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote… Also affects mozilla
- CVE-2007-0009 Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services… Also affects mozilla-firefox
- CVE-2007-0981 Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and… Also affects mozilla-firefox
- CVE-2007-0045 Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before… Also affects mozilla-firefox