MFSA 2008-13: Multiple XSS vulnerabilities from character encoding

IT セキュリティ

はせがわさんが出した、FireFoxの脆弱性のアドバイザリーが出ています。

Yosuke Hasegawa reported a flaw in the way Mozilla parses the control character 0x80 under Shift_JIS encoding. This flaw could potentially be used to evade web-site input filters and result in a XSS attack hazard. While investigating, Mozilla developer Simon Montagu discovered several variants of this flaw involving zero-length non-ASCII sequences in ISO-2022-JP, ISO-2022-CN, ISO-2022-KR, and HZ-GB-2312.

screenshot