Mozilla contributor Masahiro Yamada reported that certain invisible control characters were being decoded when displayed in the location bar, resulting in fewer visible characters than were present in the actual location. An attacker could use this vulnerability to spoof the location bar and display a misleading URL for their malicious web page.
Public now via: http://www.mozilla.org/security/announce/2009/mfsa2009-11.html
firefox-3.0.7-1.fc9, xulrunner-1.9.0.7-1.fc9, epiphany-2.22.2-8.fc9, epiphany-extensions-2.22.1-8.fc9, blam-1.8.5-6.fc9.1, chmsee-1.0.1-9.fc9, devhelp-0.19.1-9.fc9, galeon-2.0.7-7.fc9, gnome-python2-extras-2.19.1-24.fc9, gnome-web-photo-0.3-18.fc9, google-gadgets-0.10.5-3.fc9, gtkmozembedmm-1.4.2.cvs20060817-26.fc9, kazehakase-0.5.6-1.fc9.4, Miro-1.2.7-5.fc9, mozvoikko-0.9.5-7.fc9, mugshot-1.2.2-6.fc9, ruby-gnome2-0.17.0-6.fc9, totem-2.23.2-12.fc9, yelp-2.22.1-9.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
firefox-3.0.7-1.fc10, xulrunner-1.9.0.7-1.fc10, epiphany-2.24.3-3.fc10, epiphany-extensions-2.24.0-5.fc10, blam-1.8.5-7.fc10, devhelp-0.22-5.fc10, evolution-rss-0.1.2-5.fc10, galeon-2.0.7-7.fc10, gecko-sharp2-0.13-5.fc10, gnome-python2-extras-2.19.1-27.fc10, gnome-web-photo-0.3-15.fc10, google-gadgets-0.10.5-3.fc10, kazehakase-0.5.6-1.fc10.4, Miro-2.0-4.fc10, mozvoikko-0.9.5-7.fc10, mugshot-1.2.2-6.fc10, pcmanx-gtk2-0.3.8-6.fc10, ruby-gnome2-0.18.1-4.fc10, yelp-2.24.0-6.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.