CVE-2008-4066

CVE-2008-4066 affects Mozilla Firefox 2.0.0.x (e.g., 2.0.0.14 and earlier than 2.0.0.17). Description in connected advisories corroborates that HTML-escaped low surrogate characters could bypass XSS protections, enabling XSS. Affected component: Firefox HTML parser/rendering; root cause: HTML esc...

Mozilla low surrogates stripped from JavaScript before execution

Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "jav&56325ascript" sequence, a...