Vulnerability Details : CVE-2017-7764
Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts.". This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Vulnerability category: Input validation
Products affected by CVE-2017-7764
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-7764
0.31%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 71 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-7764
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
|
5.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2017-7764
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-7764
-
https://www.mozilla.org/security/advisories/mfsa2017-17/
Security vulnerabilities fixed in Thunderbird 52.2 — MozillaVendor Advisory
-
https://access.redhat.com/errata/RHSA-2017:1561
RHSA-2017:1561 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.securityfocus.com/bid/99057
Mozilla Firefox Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
-
https://www.debian.org/security/2017/dsa-3918
Debian -- Security Information -- DSA-3918-1 icedoveThird Party Advisory
-
http://www.securitytracker.com/id/1038689
Mozilla Firefox Multiple Bugs Let Remote Users Spoof URLs, Obtain Potentially Sensitive Information, and Execute Arbitrary Code and Let Local Users Gain Elevated Privileges - SecurityTrackerThird Party Advisory;VDB Entry
-
https://www.debian.org/security/2017/dsa-3881
Debian -- Security Information -- DSA-3881-1 firefox-esrThird Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2017-15/
Security vulnerabilities fixed in Firefox 54 — MozillaVendor Advisory
-
https://www.mozilla.org/security/advisories/mfsa2017-16/
Security vulnerabilities fixed in Firefox ESR 52.2 — MozillaVendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1364283
1364283 - (CVE-2017-7764) Security: disallow "Canadian Syllabics" unicode block from IDN domainsExploit;Issue Tracking;Vendor Advisory
-
http://www.unicode.org/reports/tr31/tr31-26.html#Aspirational_Use_Scripts
UAX #31: Unicode Identifier and Pattern SyntaxThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:1440
RHSA-2017:1440 - Security Advisory - Red Hat Customer PortalThird Party Advisory
Jump to