CVE-2007-3164

Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if t...

CVE-2007-3164

Technical details (affected product/version, root cause, impact or fixes) are not publicly detailed in the provided documents. Monitor for updates on CVE-2007-3164.

Microsoft Internet Explorer双字节字符内存破坏漏洞（MS06-013）

Microsoft Internet Explorer是微软发布的非常流行的WEB浏览器。 Microsoft Internet Explorer在解析双字节字符集URL时URLMON.DLL没有正确的验证包含有双字节字符集的IDN。如果用户受骗访问了恶意的Web页面或HTML邮件的话，就可能允许攻击者执行任意代码。 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 - Microsoft Windows XP SP2 - Microsoft Windows Server 2003...

FreeBSD : firefox & mozilla -- buffer overflow vulnerability (8665ebb9-2237-11da-978e-0001020eed82)

Tom Ferris reports : A buffer overflow vulnerability exists within Firefox version 1.0.6 and all other prior versions which allows for an attacker to remotely execute arbitrary code on an affected host. The problem seems to be when a hostname which has all dashes causes the NormalizeIDN call in...

[Full-disclosure] Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerability

Microsoft Internet Explorer DBCS Remote Memory Corruption Vulnerability By Sowhat of Nevis Labs Date: 2006.04.11 http://www.nevisnetworks.com http://secway.org/advisory/AD20060411.txt http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx CVE: CVE-2006-1189 Vendor Microsoft Inc. Product...

CVE-2006-1189

Microsoft Internet Explorer suffers a remote code execution vulnerability (CVE-2006-1189) due to a buffer overflow in URLMON.DLL when parsing IDNs in double-byte character sets (DBCS). Affected browsers include IE 5.01 SP4 and IE6 across Windows 98/ME/2000/XP/Server 2003, including IE6 SP1 in var...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2005:174)

Updated Mozilla Thunderbird packages fix various vulnerabilities : The run-mozilla.sh script, with debugging enabled, would allow local users to create or overwrite arbitrary files via a symlink attack on temporary files CVE-2005-2353. A bug in the way Thunderbird processes XBM images could be us...

MDKSA-2005:169 : mozilla-firefox

A number of vulnerabilities have been discovered in Mozilla Firefox that have been corrected in version 1.0.7: A bug in the way Firefox processes XBM images could be used to execute arbitrary code via a specially crafted XBM image file CVE-2005-2701. A bug in the way Firefox handles certain Unico...

Debian DSA-866-1 : mozilla - several vulnerabilities

Several security-related problems have been discovered in Mozilla and derived programs. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2871 Tom Ferris discovered a bug in the IDN hostname handling of Mozilla that allows remote attackers to cause a...

security flaw

Buffer overflow in the International Domain Name IDN support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a hostname with all "soft" hyphens character 0xAD, which is not...

Slackware 10.0 / 10.1 / 10.2 / current : Mozilla/Firefox (SSA:2005-269-01)

New Mozilla and Firefox packages are available for Slackware 10.0, 10.1, 10.2, and -current to fix security issues: MFSA 2005-59 Command-line handling on Linux allows shell execution MFSA 2005-58 Firefox 1.0.7 / Mozilla Suite 1.7.12 Vulnerability Fixes MFSA 2005-57 IDN heap overrun using...

[SECURITY] [DSA 837-1] New Mozilla Firefox packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 837-1 [email protected] http://www.debian.org/security/ Martin Schulze October 2nd, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 837-1] New Mozilla Firefox packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 837-1 [email protected] http://www.debian.org/security/ Martin Schulze October 2nd, 2005 http://www.debian.org/security/faq -...

pwnzilla.txt

/ SSSSSSS, SSSSSSS' PwnZilla 5 - One sploit fits all. FireFox optimized iSY iS; .sS Exploit for IDN host name heap buffer overrun in .SSSSSSS .sS Mozilla browsers FireFox, Mozilla and Netscape iS; .sS Copyright C 2003-2005 by Berend-Jan Wever. .SS sSSSSSSP Official release:...

IDN heap overrun using soft-hyphens — Mozilla

Tom Ferris reported a Firefox crash when processing a domain name consisting solely of soft-hyphen characters. This is due to a heap overrun triggered when Internationalized Domain Name IDN processing results in an empty string after removing non-mapping characters such as soft-hyphens. This...

Mozilla Browsers 0xAD (HOST:) Remote Heap Buffer Overrun Expl (v2)

Exploit for unknown platform in category remote exploits ===================================================================== Mozilla Browsers 0xAD HOST: Remote Heap Buffer Overrun Exploit v2 ===================================================================== / SSSSSSS, SSSSSSS' PwnZilla 5 - O...

Mozilla Thunderbird < 1.0.7 IDN URL Domain Name Overflow

The remote host is using Mozilla Thunderbird, an email client. The remote version of this software contains various security issues that could allow an attacker to execute arbitrary code on the remote host and to disguise URLs. C Tenable Network Security, Inc. include"compat.inc"; if description...

CVE-2005-2871

Buffer overflow in the International Domain Name IDN support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a hostname with all "soft" hyphens character 0xAD, which is not...

CVE-2005-2871

CVE-2005-2871 describes a heap-based buffer overflow in IDN handling (soft-hyphen 0xAD) during Mozilla Firefox IDN normalization (nsStandardURL::BuildNormalizedSpec). Affects Firefox 1.0.6 and earlier, and Netscape 7.x/8.x. Exploitation could crash the browser or run arbitrary code; remote attack...

Mozilla-based browsers contain a buffer overflow in handling URIs containing a malformed IDN hostname

Overview A vulnerability in the way Mozilla products and derivative programs handle certain malformed URIs could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Mozilla products, including the Mozilla Suite, and Mozilla Firefox are vulnerable to a buffer...