CVE-2005-2871: Buffer Overflow

Published Sep 9, 2005

Updated

Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all "soft" hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec.

Affected Software

8 affected components

Mozilla Firefox=1.0

Mozilla Firefox=1.0.1

Mozilla Firefox=1.0.2

Mozilla Firefox=1.0.3

Mozilla Firefox=1.0.4

Mozilla Firefox=1.0.5

Mozilla Firefox=1.0.6

Mozilla Firefox=1.5-beta1

Event History

Sep 9, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2871?

CVE-2005-2871 has a severity that can lead to denial of service and potential remote code execution.

How do I fix CVE-2005-2871?

To fix CVE-2005-2871, upgrade to the latest version of Mozilla Firefox or Netscape that addresses this vulnerability.

Which versions of Mozilla Firefox are affected by CVE-2005-2871?

CVE-2005-2871 affects Mozilla Firefox versions 1.0.6 and earlier.

Can CVE-2005-2871 be exploited remotely?

Yes, CVE-2005-2871 can be exploited remotely through specially crafted hostnames with 'soft' hyphens.

What impact does CVE-2005-2871 have on my system?

CVE-2005-2871 can cause your browser to crash and may allow an attacker to execute arbitrary code.