PT-2017-1270 · Google+4 · Google Chrome+4
Armin
·
Publicado
2017-01-25
·
Atualizado
2024-06-15
·
CVE-2017-5015
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android
Description
The issue is related to the incorrect handling of Unicode glyphs, which allows a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. This can be exploited by an attacker to deceive users into visiting a malicious website that appears to be a legitimate one. The vulnerability is associated with the improper processing of Unicode characters, enabling the creation of fake domain names that resemble genuine ones.
Recommendations
For Google Chrome versions prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, update to version 56.0.2924.76 or later for Linux, Windows and Mac, and 56.0.2924.87 or later for Android to resolve the issue.
At the moment, there is no information about a newer version that contains a fix for this vulnerability for Opera.
Correção
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Opera
Red Hat
Suse