Description
Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being NULL terminated.
References
- http://www.mozilla.org/security/announce/mfsa2005-06.html
- 19823 third-party-advisory
- HPSBTU01114 vendor-advisory
- 12131 vdb-entry
- 20041229 Heap overflow in Mozilla Browser <= 1.7.3 NNTP code. mailing-list
- mozilla-nntp-bo(18711) vdb-entry
- oval:org.mitre.oval:def:100052 vdb-entry signature
- http://isec.pl/vulnerabilities/isec-0020-mozilla.txt
- SUSE-SA:2006:022 vendor-advisory
- oval:org.mitre.oval:def:9808 vdb-entry signature
- RHSA-2005:038 vendor-advisory