CVE-2021-43533

published 2021-12-08

CVE-2021-43533: When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to…

Priority P4 17 medium 4.3 CVSS 3.1

AV N AC L PR N UI R S U C N I L A N

When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to user confusion or attacks such as phishing. This vulnerability affects Firefox < 94.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	firefox	< firefox 94.0-1 (sid)	firefox 94.0-1 (sid)
mozilla	firefox	< 94.0	94.0
mozilla	firefox	—	—
mozilla	firefox	>= 0 < 94.0+build3-0ubuntu0.18.04.1	94.0+build3-0ubuntu0.18.04.1
mozilla	firefox	>= 0 < 94.0+build3-0ubuntu0.20.04.1	94.0+build3-0ubuntu0.20.04.1
mozilla	firefox	>= 0 < 94.0+build3-0ubuntu1	94.0+build3-0ubuntu1
mozilla	firefox	>= unspecified < 94	94

CVSS provenance

nvd v3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

osv 4.3 MEDIUM

vendor_debian 4.3 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.