Non notée
CVE-2017-7764 Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the…
Description
Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts.". This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Firefox 54 | premières → < 54 | 54 |
| Firefox ESR 52.2 | premières → < 52.2 | 52.2 |
| Thunderbird 52.2 | premières → < 52.2 | 52.2 |
Références
- 99057 www.securityfocus.com
- www.unicode.org www.unicode.org
- www.mozilla.org www.mozilla.org
- DSA-3918 www.debian.org
- 1038689 www.securitytracker.com
- bugzilla.mozilla.org bugzilla.mozilla.org
- DSA-3881 www.debian.org
- RHSA-2017:1440 access.redhat.com
- RHSA-2017:1561 access.redhat.com
- www.mozilla.org www.mozilla.org
- www.mozilla.org www.mozilla.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Firefox
Les 2221 CVE de Firefox →
CVE-2026-120572
Incorrect boundary conditions in the Layout: Block and Inline component
8.8
Élevée
CVE-2026-118027
Frame poisoning in the Layout component
9.1
Critique
CVE-2026-118026
Invalid pointer in the JavaScript: GC component
8.8
Élevée
CVE-2026-118024
Use-after-free in the Graphics: Text component
8.8
Élevée