Errors parsing URLs with leading whitespace and control characters

Related Vulnerabilities: CVE-2008-5508  

Mozilla Foundation Security Advisory 2008-66

Errors parsing URLs with leading whitespace and control characters

Announced
December 16, 2008
Reporter
Chip Salzenberg
Impact
Low
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 2.0.0.19
  • Firefox 3.0.5
  • SeaMonkey 1.1.14
  • Thunderbird 2.0.0.19

Description

Perl developer Chip Salzenberg reported that certain control characters, when placed at the beginning of a URL, would lead to incorrect parsing resulting in a malformed URL being output by the parser. IBM researchers Justin Schuh, Tom Cross, and Peter William also reported a related symptom as part of their research that resulted in MFSA 2008-37.

There was no direct security impact from this issue and its effect was limited to the improper rendering of hyperlinks containing specific characters. The severity of this issue was determined to be low.

References