CVE-2005-2871: Mozilla Firefox

High severity, CVSS 7.5. EPSS: 21.1% chance of exploitation in the next 30 days.

Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a hostname with all "soft" hyphens (character 0xAD), which is not properly handled by the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec.

Affected products

• Mozilla Firefox: version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; version 1.0.5 only; …

Published 2005-09-09. Last modified 2026-06-16.