Description
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with "zero-width non-joiner" characters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.9.2-2.4.7 | RHSA-2005:789 |
| RHEL 4 | firefox +1 | 1.0.7-1.4.1 | RHSA-2005:791, RHSA-2005:785 |
Advisories 6
- RHSA-2005:791 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:789 Red Hat Security Advisory: mozilla security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:785 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-868-1 mozilla-thunderbird - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-838-1 mozilla-firefox - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-866-1 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2005:169 vendor-advisory
- DSA-868 vendor-advisory
- ADV-2005-1824 vdb-entry
- FLSA-2006:168375 vendor-advisory
- 14918 vdb-entry
- 15495 vdb-entry
- 1014954 vdb-entry
- RHSA-2005:789 vendor-advisory
- oval:org.mitre.oval:def:11609 vdb-entry signature
- 17026 third-party-advisory
- RHSA-2005:791 vendor-advisory
- USN-200-1 vendor-advisory
- 17042 third-party-advisory
- DSA-866 vendor-advisory
- mozilla-zerowidthnonjoiner-stack-corruption(22375) vdb-entry
- http://www.mozilla.org/security/announce/mfsa2005-58.html
- oval:org.mitre.oval:def:1150 vdb-entry signature
- 17284 third-party-advisory
- 17149 third-party-advisory
- 17263 third-party-advisory
- 16917 third-party-advisory
- DSA-838 vendor-advisory
- 17014 third-party-advisory
- RHSA-2005:785 vendor-advisory
- SUSE-SA:2005:058 vendor-advisory
- MDKSA-2005:174 vendor-advisory
- 17090 third-party-advisory
- 16911 third-party-advisory
- 16977 third-party-advisory
- MDKSA-2005:170 vendor-advisory