CVE-2017-5383: Input Validation
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1Fixed in 115.4.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 45.7 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 51 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 45.7 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 45.7.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5375
- CVE-2017-5376
- CVE-2017-5378
- CVE-2017-5380
- CVE-2017-5390
- CVE-2017-5396
- CVE-2017-5383
- CVE-2017-5373
- CVE-2017-5377
- CVE-2017-5379
- CVE-2017-5389
- CVE-2017-5381
- CVE-2017-5382
- CVE-2017-5384
- CVE-2017-5385
- CVE-2017-5386
- CVE-2017-5394
- CVE-2017-5391
- CVE-2017-5392
- CVE-2017-5393
- CVE-2017-5395
- CVE-2017-5387
- CVE-2017-5388
- CVE-2017-5374
Frequently Asked Questions
What is the severity of CVE-2017-5383?
CVE-2017-5383 has been classified with a moderate severity level due to potential domain name spoofing attacks.
How do I fix CVE-2017-5383?
To fix CVE-2017-5383, upgrade affected software such as Firefox and Thunderbird to the latest versions that have addressed this vulnerability.
Which software versions are affected by CVE-2017-5383?
CVE-2017-5383 affects multiple versions of Firefox ESR, Firefox, Thunderbird, and various Debian packages before their respective patched releases.
What kind of attacks can CVE-2017-5383 facilitate?
CVE-2017-5383 can facilitate domain name spoofing attacks, potentially misleading users about the authenticity of URLs in the browser's location bar.
Is CVE-2017-5383 specific to any operating system?
CVE-2017-5383 affects numerous operating systems, including various versions of Debian and Red Hat Enterprise Linux, due to vulnerabilities in their browsers.