CVE-2017-7833: Input Validation
Last updated 24 July 2024
Other sources
Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character with some font sets on the addressbar. The non-Latin character will not be visible to most viewers. This allows for domain spoofing attacks because these combined domain names do not display as punycode.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-7833?
CVE-2017-7833 is a vulnerability that allows Arabic and Indic vowel marker characters to be combined with Latin characters in a domain name, allowing for domain spoofing attacks.
How does CVE-2017-7833 work?
CVE-2017-7833 allows the non-Latin character in a domain name to be hidden from most viewers, enabling domain spoofing attacks.
What software is affected by CVE-2017-7833?
Mozilla Firefox version up to and excluding 57.0.2, and certain versions of Ubuntu and Debian with Firefox.
What is the severity of CVE-2017-7833?
CVE-2017-7833 has a severity rating of 5.3, which is considered medium.
How can I fix CVE-2017-7833?
Upgrade to Mozilla Firefox version 57.0.2 or above, or follow the provided remedies for Ubuntu and Debian versions.