Buffer overflow on Unicode URL parsing within JavaScript processor.
vulners.com/securityvulns/securityvulns:doc:11133
vulners.com/securityvulns/securityvulns:doc:11145