CVE-2005-2871
- State
- Published
- Severity
- Not scored
- Published
- Sep 9, 2005
- Updated
- Aug 7, 2024
- Reserved
- Sep 9, 2005
Description
Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all "soft" hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- VU#573857third-party-advisory
- DSA-868vendor-advisory
- ADV-2005-1824vdb-entry
- FLSA-2006:168375vendor-advisory
- ADV-2005-1690vdb-entry
- 83third-party-advisory
- 16767third-party-advisory
- oval:org.mitre.oval:def:1287vdb-entrysignature
- ADV-2005-1691vdb-entry
- 16764third-party-advisory
- DSA-837vendor-advisory
- oval:org.mitre.oval:def:584vdb-entrysignature
- USN-181-1vendor-advisory
- RHSA-2005:791vendor-advisory
- 17042third-party-advisory
- 14784vdb-entry
- oval:org.mitre.oval:def:9608vdb-entrysignature
- 16766third-party-advisory
- DSA-866vendor-advisory
- http://www.security-protocols.com/advisory/sp-x17-advisory.txt
- 20050911 FireFox "Host:" Buffer Overflow is not just exploitable on FireFoxmailing-list
- RHSA-2005:769vendor-advisory
- 1014877vdb-entry
- http://www.mozilla.org/security/announce/mfsa2005-57.html
- http://www.securiteam.com/securitynews/5RP0B0UGVW.html
- 17284third-party-advisory
- 19255vdb-entry
- 17263third-party-advisory
- RHSA-2005:768vendor-advisory
- P-303third-party-advisorygovernment-resource
- GLSA-200509-11vendor-advisory
- http://www.security-protocols.com/firefox-death.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=307259
- MDKSA-2005:174vendor-advisory
- 17090third-party-advisory
- 20050909 Mozilla Firefox "Host:" Buffer Overflowmailing-list
- mozilla-url-bo(22207)vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.