Last modified: 2012-04-12 13:54:24 UTC
Wikipedia user Suffusion of Yellow discovered a CSS injection vulnerability, which occurs when CSS comments /* ... */ are escaped with backslashes: \2f\2a ... \2a\2f. The bug is due to an error in the CSS escape sequence normalisation code which we introduced to fix bug 23687. As with any CSS injection vulnerability, the impact is complete account compromise (XSS) for Internet Explorer users, and possible privacy loss due to arbitrary remote image embedding for users of other browsers.
Was fixed in r85856
Basic test added with r100584