full-disclosure - Re: Mozilla Firefox up to 1.0.6 and Mozilla Thunderbird up to 1.0 url string obfuscation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200508100100.51277.alexamici@fastwebnet.it>
Date: Wed Aug 10 01:19:17 2005
From: alexamici at fastwebnet.it (Alessandro Amici)
Subject: Re: Mozilla Firefox up to 1.0.6 and Mozilla
	Thunderbird up to 1.0 url string obfuscation

Marc,

On Tuesday 09 August 2005 15:22, Marc Ruef wrote:
> After I have entered the _very_ long URL (approx. 5.474 chars) in the
> address bar of the browser the whole line went blank. I was not able to see
> my input - It looked like deleted, empty.

on Debian sid I see a slightly different problem.

Platform:
Debian GNU/Linux unstable as of 2005-08-10
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.10) Gecko/20050730 
Firefox/1.0.6 (Debian package 1.0.6-2)

Inserting manually a long URL in the address bar (or in the search shortcut, 
for the matter) resulted in damaged text. It looks like the long line wraps 
and the bar contains the superposition of pieces of the URL with a shift of a 
few pixels. The damaged text is perfectly visible and pretty allarming, too.

Cheers,
Alessandro

--
B-Open Solutions srl - http://www.bopen.it/