Description
Mozilla before 1.6 does not display the entire URL in the status bar when a link contains %00, which could allow remote attackers to trick users into clicking on unknown or untrusted sites and facilitate phishing attacks.
References (3)
Core 3
Core References
Exploit third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/10419/
Various Sources x_refsource_confirm
http://www.mozilla.org/projects/security/known-vulnerabilities.html
Exploit, Patch x_refsource_confirm
http://bugzilla.mozilla.org/show_bug.cgi?id=228176
Scores
EPSS
0.0139
EPSS Percentile
69.3%
Details
Status
published
Products (27)
mozilla/mozilla
0.8
mozilla/mozilla
0.9.2
mozilla/mozilla
0.9.2.1
mozilla/mozilla
0.9.3
mozilla/mozilla
0.9.4
mozilla/mozilla
0.9.4.1
mozilla/mozilla
0.9.5
mozilla/mozilla
0.9.6
mozilla/mozilla
0.9.7
mozilla/mozilla
0.9.8
... and 17 more
Published
Dec 31, 2004
Tracked Since
Feb 18, 2026