CVE-2017-5383

Description

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

References

https://www.mozilla.org/security/advisories/mfsa2017-03/

https://www.mozilla.org/security/advisories/mfsa2017-02/

https://www.mozilla.org/security/advisories/mfsa2017-01/

https://www.debian.org/security/2017/dsa-3832

https://www.debian.org/security/2017/dsa-3771

https://security.gentoo.org/glsa/201702-22

https://security.gentoo.org/glsa/201702-13

https://bugzilla.mozilla.org/show_bug.cgi?id=1324716

https://bugzilla.mozilla.org/show_bug.cgi?id=1323338

http://www.securitytracker.com/id/1037693

http://www.securityfocus.com/bid/95769

http://rhn.redhat.com/errata/RHSA-2017-0238.html

http://rhn.redhat.com/errata/RHSA-2017-0190.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3