CVE-2017-7764: Input Validation
Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts."
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5472
- CVE-2017-7749
- CVE-2017-7750
- CVE-2017-7751
- CVE-2017-7755
- CVE-2017-7752
- CVE-2017-7754
- CVE-2017-7756
- CVE-2017-7757
- CVE-2017-7778
- CVE-2017-7758
- CVE-2017-7763
- CVE-2017-7764
- CVE-2017-7765
- CVE-2017-5470
- CVE-2017-7759
- CVE-2017-7760
- CVE-2017-7761
- CVE-2017-7762
- CVE-2017-7766
- CVE-2017-7767
- CVE-2017-7768
- CVE-2017-7770
- CVE-2017-5471
Frequently Asked Questions
What is the severity of CVE-2017-7764?
CVE-2017-7764 has a moderate severity level, potentially allowing domain name spoofing attacks.
How do I fix CVE-2017-7764?
To fix CVE-2017-7764, update your affected Mozilla products to the latest versions recommended by Mozilla.
Which products are affected by CVE-2017-7764?
CVE-2017-7764 affects Mozilla Firefox versions up to 54, Firefox ESR up to 52.2, and Thunderbird up to 52.2.
Can CVE-2017-7764 allow for phishing attacks?
Yes, CVE-2017-7764 can potentially be exploited for phishing attacks due to character confusion in the address bar.
Is there a workaround for CVE-2017-7764?
There is no documented workaround for CVE-2017-7764, so it is critical to apply the necessary updates.