search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Mozilla contains heap overflow in UTF8 conversion of hostname portion of URLs

Vulnerability Note VU#808216

Original Release Date: 2004-09-17 | Last Revised: 2004-09-17


A vulnerability in the way Mozilla and its derived programs handle certain malformed URLs could allow a remote attacker to execute arbitrary code on a vulnerable system.


A vulnerability exists in the way that some versions of the Mozilla and Firefox web browsers, and Thunderbird email client handle long URLs containing non-ASCII characters. The vulnerability results from a buffer overflow error in heap memory that occurs during UTF8 conversion of the hostname portion of the URL. This vulnerability could be exploited by a remote attacker by supplying a specially crafted URL in a web page or email message.


A remote attacker may be able to execute arbitrary code with the privileges of the user running an affected program.


Upgrade to a fixed version of the affected software

The Mozilla Project has released new versions of the affected software that include patches for this vulnerability. Please see the Systems Affected section of this document for more information.

Vendor Information


Mozilla Affected

Updated:  September 17, 2004



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The Mozilla project has released the following versions of the affected software that contain a patch for this issue:

Users are strongly encouraged to upgrade to one of these versions.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector
Base 0 AV:--/AC:--/Au:--/C:--/I:--/A:--
Temporal 0 E:ND/RL:ND/RC:ND
Environmental 0 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND



Information about this issue was originally published by the Mozilla Project. The Mozilla Project, in turn, credits Gaël Delalleau and Mats Palmgren with independent discoveries of this issue.

This document was written by Chad R Dougherty.

Other Information

CVE IDs: None
Severity Metric: 28.59
Date Public: 2004-09-14
Date First Published: 2004-09-17
Date Last Updated: 2004-09-17 18:08 UTC
Document Revision: 9

Sponsored by CISA.