CVE-2005-2871

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 21.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-09-09 · updated 2026-06-16

Description

Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all "soft" hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec.

Affected products

Mozilla Firefox: 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+2)

References

http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0316.html
http://marc.info/?l=full-disclosure&m=112624614008387&w=2
http://secunia.com/advisories/16764
http://secunia.com/advisories/16766
http://secunia.com/advisories/16767
http://secunia.com/advisories/17042
http://secunia.com/advisories/17090
http://secunia.com/advisories/17263
http://secunia.com/advisories/17284
http://securityreason.com/securityalert/83
http://securitytracker.com/id?1014877
http://www.ciac.org/ciac/bulletins/p-303.shtml

Get alerted when CVE-2005-2871 or the next vulnerability affects your stack