medium5.3
CVE-2017-5383
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks i…
Impact
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Debian | Debian Linux | Version 8.0 |
| Redhat | Enterprise Linux | Versions 5.0, 6.0, 7.0 |
| Redhat | Enterprise Linux Desktop | Versions 5.0, 6.0, 7.0 |
| Redhat | Enterprise Linux Server | Versions 5.0, 6.0, 7.0 |
| Redhat | Enterprise Linux Server Aus | Versions 7.3, 7.4 |
| Redhat | Enterprise Linux Server Eus | Versions 7.3, 7.4, 7.5 |
| Redhat | Enterprise Linux Workstation | Versions 5.0, 6.0, 7.0 |
| Mozilla | Thunderbird | before 45.7.0 |
| Mozilla | Firefox | before 51.0 before 45.7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://rhn.redhat.com/errata/RHSA-2017-0190.html
- http://rhn.redhat.com/errata/RHSA-2017-0238.html
- http://www.securityfocus.com/bid/95769
- http://www.securitytracker.com/id/1037693
- https://bugzilla.mozilla.org/show_bug.cgi?id=1323338
- https://bugzilla.mozilla.org/show_bug.cgi?id=1324716
- https://security.gentoo.org/glsa/201702-13
- https://security.gentoo.org/glsa/201702-22
- https://www.debian.org/security/2017/dsa-3771
- https://www.debian.org/security/2017/dsa-3832
- https://www.mozilla.org/security/advisories/mfsa2017-01/
- https://www.mozilla.org/security/advisories/mfsa2017-02/
- https://www.mozilla.org/security/advisories/mfsa2017-03/
- http://rhn.redhat.com/errata/RHSA-2017-0190.html
- http://rhn.redhat.com/errata/RHSA-2017-0238.html
- http://www.securityfocus.com/bid/95769
- http://www.securitytracker.com/id/1037693
- https://bugzilla.mozilla.org/show_bug.cgi?id=1323338
- https://bugzilla.mozilla.org/show_bug.cgi?id=1324716
- https://security.gentoo.org/glsa/201702-13
- https://security.gentoo.org/glsa/201702-22
- https://www.debian.org/security/2017/dsa-3771
- https://www.debian.org/security/2017/dsa-3832
- https://www.mozilla.org/security/advisories/mfsa2017-01/
- https://www.mozilla.org/security/advisories/mfsa2017-02/