You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2010-61
Mozilla Foundation Security Advisory 2010-61
Title: UTF-7 XSS by overriding document charset using <object> type attribute
Impact: High
Announced: September 7, 2010
Reporter: David Huang, Collin Jackson
Products: Firefox, Thunderbird, SeaMonkey
Fixed in: Firefox 3.6.9
Firefox 3.5.12
Thunderbird 3.1.3
Thunderbird 3.0.7
SeaMonkey 2.0.7
Description
Security researchers David Huang
and Collin Jackson of Carnegie Mellon University
CyLab (Silicon Valley campus) reported that the type
attribute of an <object> tag can override the charset of a
framed HTML document, even when the document is included across
origins. A page could be constructed containing such an
<object> tag which sets the charset of the framed document to
UTF-7. This could potentially allow an attacker to inject UTF-7
encoded JavaScript into a site, bypassing the site's XSS filters, and
then executing the code using the above technique.
