CVE-2017-7833 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input Validation12 documents5 sources
Severity
5.3MEDIUMNVD
OSV9.8
EPSS
1.1%
top 22.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedJun 11
Latest updateMay 14

Description

Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character with some font sets on the addressbar. The non-Latin character will not be visible to most viewers. This allows for domain spoofing attacks because these combined domain names do not display as punycode. This vulnerability affects Firefox < 57.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/firefox< firefox 57.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 57
▶Ubuntumozilla/firefox< 57.0+build4-0ubuntu0.14.04.4+8
▶NVDmozilla/firefox56.0.2

🔴Vulnerability Details

6
GHSA
GHSA-9qx9-m59p-96gr: Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character with some font↗2022-05-14
▶
OSV
firefox regression↗2018-01-03
▶
OSV
firefox regressions↗2017-12-01
▶
OSV
firefox regression↗2017-11-27
▶
OSV
firefox vulnerabilities↗2017-11-16
▶

📋Vendor Advisories

5
Ubuntu
Firefox regression↗2018-01-03
▶
Ubuntu
Firefox regressions↗2017-12-01
▶
Ubuntu
Firefox regression↗2017-11-27
▶
Ubuntu
Firefox vulnerabilities↗2017-11-16
▶
Debian
CVE-2017-7833: firefox - Some Arabic and Indic vowel marker characters can be combined with Latin charact...↗2017
▶