vulnwire
5.3med

CVE-2017-7764

Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 80%
Public exploits
0
none known

Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts.". This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

Exploit prediction (EPSS)

1.96% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Mozilla Firefox
  • Mozilla Firefox ESR
  • Mozilla Thunderbird

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • securityfocus.com /bid/99057 · vdb-entry, x_refsource_BID, x_transferred
  • unicode.org /reports/tr31/tr31-26.html#Aspirational_Use_Scripts · x_refsource_MISC, x_transferred
  • mozilla.org /security/advisories/mfsa2017-15/ · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2017/dsa-3918 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securitytracker.com /id/1038689 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • bugzilla.mozilla.org /show_bug.cgi?id=1364283 · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2017/dsa-3881 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • access.redhat.com /errata/RHSA-2017:1440 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:1561 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • mozilla.org /security/advisories/mfsa2017-17/ · x_refsource_CONFIRM, x_transferred
  • mozilla.org /security/advisories/mfsa2017-16/ · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.