CVE-2017-5383: Input Validation
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5375
- CVE-2017-5376
- CVE-2017-5378
- CVE-2017-5380
- CVE-2017-5390
- CVE-2017-5396
- CVE-2017-5383
- CVE-2017-5373
- CVE-2017-5377
- CVE-2017-5379
- CVE-2017-5389
- CVE-2017-5381
- CVE-2017-5382
- CVE-2017-5384
- CVE-2017-5385
- CVE-2017-5386
- CVE-2017-5394
- CVE-2017-5391
- CVE-2017-5392
- CVE-2017-5393
- CVE-2017-5395
- CVE-2017-5387
- CVE-2017-5388
- CVE-2017-5374
Frequently Asked Questions
What is the severity of CVE-2017-5383?
CVE-2017-5383 has been classified with a moderate severity level due to potential domain name spoofing attacks.
How do I fix CVE-2017-5383?
To fix CVE-2017-5383, upgrade affected software such as Firefox and Thunderbird to the latest versions that have addressed this vulnerability.
Which software versions are affected by CVE-2017-5383?
CVE-2017-5383 affects multiple versions of Firefox ESR, Firefox, Thunderbird, and various Debian packages before their respective patched releases.
What kind of attacks can CVE-2017-5383 facilitate?
CVE-2017-5383 can facilitate domain name spoofing attacks, potentially misleading users about the authenticity of URLs in the browser's location bar.
Is CVE-2017-5383 specific to any operating system?
CVE-2017-5383 affects numerous operating systems, including various versions of Debian and Red Hat Enterprise Linux, due to vulnerabilities in their browsers.