CVE-2017-7838: Input Validation
Last updated 24 July 2024
Other sources
Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the punycode display instead of the primary domain being displayed in native script and the sub-domain only displaying as punycode. This could be used for limited spoofing attacks due to user confusion.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-7838?
CVE-2017-7838 is a vulnerability where Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the punycode display instead of the primary domain being displayed in native script and the sub-domain only displaying as punycode.
Which software is affected by CVE-2017-7838?
Mozilla Firefox versions up to and excluding 57.0.2, as well as Ubuntu packages firefox 57.0, 57.0+, and 57.0.1+, are affected by this vulnerability.
What is the severity of CVE-2017-7838?
The severity of CVE-2017-7838 is medium with a CVSS score of 5.3.
How can I fix CVE-2017-7838?
To fix CVE-2017-7838, update Mozilla Firefox to version 57.0.2 or later, or update the affected Ubuntu packages to the recommended versions.
Where can I find more information about CVE-2017-7838?
You can find more information about CVE-2017-7838 on the Mozilla Bugzilla and Mozilla Security Advisories websites, as well as on the SecurityFocus website.