PT-2017-4030 · Mozilla+2 · Firefox+2
Jonathan Kew
·
Published
2017-10-15
·
Updated
2024-12-12
·
CVE-2017-7832
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 57
Description
The issue allows for domain spoofing attacks by exploiting the display of combined characters in the address bar. Specifically, the dotless version of the letter 'i' followed by an accent can be used to spoof the combined, single character version of the letter 'i' with the same accent in Unicode, such as acute or grave. This is possible because most font sets do not display these combined domain names as punycode. The vulnerability can be exploited by a remote attacker to conduct spoofing attacks.
Recommendations
For Firefox versions prior to 57, update to version 57 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially spoofed domains until the update is applied.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox
Ubuntu