Mozilla Foundation Security Advisory 2008-66

Mozilla Foundation Security Advisory 2008-66

Title: Errors parsing URLs with leading whitespace and control characters
Impact: Low
Announced: December 16, 2008
Reporter: Chip Salzenberg
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 3.0.5
Firefox 2.0.0.19
Thunderbird 2.0.0.19
SeaMonkey 1.1.14
Description

Perl developer Chip Salzenberg reported that certain control characters, when placed at the beginning of a URL, would lead to incorrect parsing resulting in a malformed URL being output by the parser. IBM researchers Justin Schuh, Tom Cross, and Peter William also reported a related symptom as part of their research that resulted in MFSA 2008-37.

There was no direct security impact from this issue and its effect was limited to the improper rendering of hyperlinks containing specific characters. The severity of this issue was determined to be low.
References

* Control characters in URL bug
* Leading URL whitespace bug
* CVE-2008-5508