Mozilla Foundation Security Advisory 2009-25

Mozilla Foundation Security Advisory 2009-25

Title: URL spoofing with invalid unicode characters
Impact: Low
Announced: June 11, 2009
Reporter: Pavel Cvrcek
Products: Firefox, SeaMonkey

Fixed in: Firefox 3.0.11
SeaMonkey 1.1.17
Description

Mozilla add-on developer Pavel Cvrcek reported that certain invalid unicode characters, when used as part of an IDN, are displayed as whitespace in the location bar. This whitespace could be used to force part of the URL out of view in the location bar. An attacker could use this vulnerability to spoof the location bar and display a misleading URL for their malicious web page.
References

* https://bugzilla.mozilla.org/show_bug.cgi?id=479413
* CVE-2009-1834