PT-2017-16470 · Mozilla+5 · Firefox Esr+7

Armin Ebert

·

Publicado

2017-01-24

·

Atualizado

2024-12-12

·

CVE-2017-5383

CVSS v3.1

5.3

Média

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 45.7 Firefox ESR versions prior to 45.7 Firefox versions prior to 51
Description The issue allows for domain name spoofing attacks in the location bar due to URLs containing certain unicode glyphs for alternative hyphens and quotes not properly triggering punycode display.
Recommendations For Thunderbird versions prior to 45.7, update to version 45.7 or later. For Firefox ESR versions prior to 45.7, update to version 45.7 or later. For Firefox versions prior to 51, update to version 51 or later.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2017-1089
ALT-PU-2017-1138
ALT-PU-2017-1578
CESA-2017_0190
CESA-2017_0238
CVE-2017-5383
DLA-800-1
DLA-896-1
DSA-3771-1
DSA-3832-1
MGASA-2017-0023
MGASA-2017-0039
MGASA-2017-0323
OPENSUSE-SU-2017:0354-1
OPENSUSE-SU-2017:0357-1
OPENSUSE-SU-2017_0358-1
OPENSUSE-SU-2024:10600-1
OPENSUSE-SU-2024:10601-1
OPENSUSE-SU-2024:14572-1
RHSA-2017:0190
RHSA-2017:0238
RHSA-2017_0190
RHSA-2017_0238
SUSE-SU-2017:0426-1
SUSE-SU-2017:0427-1
USN-3165-1
USN-3175-1
USN-3175-2

Produtos afetados

Alt Linux
Centos
Firefox
Firefox Esr
Red Hat
Suse
Thunderbird
Ubuntu