CVE-2017-5383

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 83%
Affected Products (NVD)
VendorProductVersion
debiandebian_linux
8.0
redhatenterprise_linux
5.0
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
redhatenterprise_linux_desktop
5.0
redhatenterprise_linux_desktop
6.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
5.0
redhatenterprise_linux_server
6.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.3
redhatenterprise_linux_server_aus
7.4
redhatenterprise_linux_server_eus
7.3
redhatenterprise_linux_server_eus
7.4
redhatenterprise_linux_server_eus
7.5
redhatenterprise_linux_workstation
5.0
redhatenterprise_linux_workstation
6.0
redhatenterprise_linux_workstation
7.0
mozillathunderbird
𝑥
< 45.7.0
mozillafirefox
𝑥
< 51.0
mozillafirefox
𝑥
< 45.7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
firefox-esr
bookworm
115.14.0esr-1~deb12u1
fixed
bookworm (security)
128.4.0esr-1~deb12u1
fixed
bullseye
115.14.0esr-1~deb11u1
fixed
bullseye (security)
128.4.0esr-1~deb11u1
fixed
sid
128.4.0esr-1
fixed
trixie
128.3.1esr-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
precise
Fixed 51.0.1+build2-0ubuntu0.12.04.1
released
trusty
Fixed 51.0.1+build2-0ubuntu0.14.04.1
released
xenial
Fixed 51.0.1+build2-0ubuntu0.16.04.1
released
yakkety
Fixed 51.0.1+build2-0ubuntu0.16.10.1
released
zesty
Fixed 52.0.1+build2-0ubuntu1
released
thunderbird
precise
Fixed 1:45.7.0+build1-0ubuntu0.12.04.1
released
trusty
Fixed 1:45.7.0+build1-0ubuntu0.14.04.1
released
xenial
Fixed 1:45.7.0+build1-0ubuntu0.16.04.1
released
yakkety
Fixed 1:45.7.0+build1-0ubuntu0.16.10.1
released
zesty
Fixed 1:45.7.0+build1-0ubuntu1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
MozillaFirefox
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise desktop 15 SP1
60.6.2-3.32.1
fixed
suse enterprise desktop 15 SP2
68.8.0-3.87.1
fixed
suse enterprise desktop 15 SP3
78.10.0-8.38.1
fixed
suse enterprise desktop 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise desktop 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise desktop 15 SP6
115.10.0-150200.152.134.1
fixed
suse enterprise desktop 15 SP7
128.9.0-150200.152.176.1
fixed
suse enterprise sap 12 SP5
68.1.0-109.92.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise sap 15 SP1
60.6.2-3.32.1
fixed
suse enterprise sap 15 SP2
68.8.0-3.87.1
fixed
suse enterprise sap 15 SP3
78.10.0-8.38.1
fixed
suse enterprise sap 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise sap 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise sap 15 SP6
115.10.0-150200.152.134.1
fixed
suse enterprise sap 15 SP7
128.9.0-150200.152.176.1
fixed
suse enterprise server 12 SP5
68.1.0-109.92.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
suse enterprise server 15 SP1
60.6.2-3.32.1
fixed
suse enterprise server 15 SP2
68.8.0-3.87.1
fixed
suse enterprise server 15 SP3
78.10.0-8.38.1
fixed
suse enterprise server 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise server 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise server 15 SP6
115.10.0-150200.152.134.1
fixed
suse enterprise server 15 SP7
128.9.0-150200.152.176.1
fixed
MozillaFirefox-devel
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise desktop 15 SP1
60.6.2-3.32.1
fixed
suse enterprise desktop 15 SP2
68.8.0-3.87.1
fixed
suse enterprise desktop 15 SP3
78.10.0-8.38.1
fixed
suse enterprise desktop 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise desktop 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise desktop 15 SP6
102.12.0-150200.152.90.1
fixed
suse enterprise desktop 15 SP7
102.12.0-150200.152.90.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise sap 15 SP1
60.6.2-3.32.1
fixed
suse enterprise sap 15 SP2
68.8.0-3.87.1
fixed
suse enterprise sap 15 SP3
78.10.0-8.38.1
fixed
suse enterprise sap 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise sap 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise sap 15 SP6
102.12.0-150200.152.90.1
fixed
suse enterprise sap 15 SP7
102.12.0-150200.152.90.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
suse enterprise server 15 SP1
60.6.2-3.32.1
fixed
suse enterprise server 15 SP2
68.8.0-3.87.1
fixed
suse enterprise server 15 SP3
78.10.0-8.38.1
fixed
suse enterprise server 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise server 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise server 15 SP6
102.12.0-150200.152.90.1
fixed
suse enterprise server 15 SP7
102.12.0-150200.152.90.1
fixed
MozillaFirefox-translations-common
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise desktop 15 SP1
60.6.2-3.32.1
fixed
suse enterprise desktop 15 SP2
68.8.0-3.87.1
fixed
suse enterprise desktop 15 SP3
78.10.0-8.38.1
fixed
suse enterprise desktop 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise desktop 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise desktop 15 SP6
115.10.0-150200.152.134.1
fixed
suse enterprise desktop 15 SP7
128.9.0-150200.152.176.1
fixed
suse enterprise sap 12 SP5
68.1.0-109.92.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise sap 15 SP1
60.6.2-3.32.1
fixed
suse enterprise sap 15 SP2
68.8.0-3.87.1
fixed
suse enterprise sap 15 SP3
78.10.0-8.38.1
fixed
suse enterprise sap 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise sap 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise sap 15 SP6
115.10.0-150200.152.134.1
fixed
suse enterprise sap 15 SP7
128.9.0-150200.152.176.1
fixed
suse enterprise server 12 SP5
68.1.0-109.92.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
suse enterprise server 15 SP1
60.6.2-3.32.1
fixed
suse enterprise server 15 SP2
68.8.0-3.87.1
fixed
suse enterprise server 15 SP3
78.10.0-8.38.1
fixed
suse enterprise server 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise server 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise server 15 SP6
115.10.0-150200.152.134.1
fixed
suse enterprise server 15 SP7
128.9.0-150200.152.176.1
fixed
MozillaFirefox-translations-other
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise desktop 15 SP1
60.6.2-3.32.1
fixed
suse enterprise desktop 15 SP2
68.8.0-3.87.1
fixed
suse enterprise desktop 15 SP3
78.10.0-8.38.1
fixed
suse enterprise desktop 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise desktop 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise desktop 15 SP6
115.10.0-150200.152.134.1
fixed
suse enterprise desktop 15 SP7
128.9.0-150200.152.176.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise sap 15 SP1
60.6.2-3.32.1
fixed
suse enterprise sap 15 SP2
68.8.0-3.87.1
fixed
suse enterprise sap 15 SP3
78.10.0-8.38.1
fixed
suse enterprise sap 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise sap 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise sap 15 SP6
115.10.0-150200.152.134.1
fixed
suse enterprise sap 15 SP7
128.9.0-150200.152.176.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
suse enterprise server 15 SP1
60.6.2-3.32.1
fixed
suse enterprise server 15 SP2
68.8.0-3.87.1
fixed
suse enterprise server 15 SP3
78.10.0-8.38.1
fixed
suse enterprise server 15 SP4
91.8.0-150200.152.26.1
fixed
suse enterprise server 15 SP5
102.11.0-150200.152.87.1
fixed
suse enterprise server 15 SP6
115.10.0-150200.152.134.1
fixed
suse enterprise server 15 SP7
128.9.0-150200.152.176.1
fixed
MozillaThunderbird
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise desktop 15 SP2
68.8.0-3.80.2
fixed
suse enterprise desktop 15 SP3
78.10.0-8.23.1
fixed
suse enterprise desktop 15 SP4
91.8.0-150200.8.65.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15 SP2
68.8.0-3.80.2
fixed
suse enterprise sap 15 SP3
78.10.0-8.23.1
fixed
suse enterprise sap 15 SP4
91.8.0-150200.8.65.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15 SP2
68.8.0-3.80.2
fixed
suse enterprise server 15 SP3
78.10.0-8.23.1
fixed
suse enterprise server 15 SP4
91.8.0-150200.8.65.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15 SP2
68.8.0-3.80.2
fixed
suse enterprise workstation 15 SP3
78.10.0-8.23.1
fixed
suse enterprise workstation 15 SP4
91.8.0-150200.8.65.1
fixed
MozillaThunderbird-devel
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise workstation 15
52.8-1.2
fixed
MozillaThunderbird-translations-common
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise desktop 15 SP2
68.8.0-3.80.2
fixed
suse enterprise desktop 15 SP3
78.10.0-8.23.1
fixed
suse enterprise desktop 15 SP4
91.8.0-150200.8.65.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15 SP2
68.8.0-3.80.2
fixed
suse enterprise sap 15 SP3
78.10.0-8.23.1
fixed
suse enterprise sap 15 SP4
91.8.0-150200.8.65.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15 SP2
68.8.0-3.80.2
fixed
suse enterprise server 15 SP3
78.10.0-8.23.1
fixed
suse enterprise server 15 SP4
91.8.0-150200.8.65.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15 SP2
68.8.0-3.80.2
fixed
suse enterprise workstation 15 SP3
78.10.0-8.23.1
fixed
suse enterprise workstation 15 SP4
91.8.0-150200.8.65.1
fixed
MozillaThunderbird-translations-other
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise desktop 15 SP2
68.8.0-3.80.2
fixed
suse enterprise desktop 15 SP3
78.10.0-8.23.1
fixed
suse enterprise desktop 15 SP4
91.8.0-150200.8.65.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15 SP2
68.8.0-3.80.2
fixed
suse enterprise sap 15 SP3
78.10.0-8.23.1
fixed
suse enterprise sap 15 SP4
91.8.0-150200.8.65.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15 SP2
68.8.0-3.80.2
fixed
suse enterprise server 15 SP3
78.10.0-8.23.1
fixed
suse enterprise server 15 SP4
91.8.0-150200.8.65.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15 SP2
68.8.0-3.80.2
fixed
suse enterprise workstation 15 SP3
78.10.0-8.23.1
fixed
suse enterprise workstation 15 SP4
91.8.0-150200.8.65.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
firefox
RHEL 6
0:45.7.0-2.el6_8
fixed
RHEL 7
0:45.7.0-2.el7_3
fixed
thunderbird
RHEL 6
0:45.7.0-1.el6_8
fixed
RHEL 7
0:45.7.0-1.el7_3
fixed
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2017-0190.html
http://rhn.redhat.com/errata/RHSA-2017-0238.html
http://www.securityfocus.com/bid/95769
http://www.securitytracker.com/id/1037693
https://bugzilla.mozilla.org/show_bug.cgi?id=1323338
https://bugzilla.mozilla.org/show_bug.cgi?id=1324716
https://security.gentoo.org/glsa/201702-13
https://security.gentoo.org/glsa/201702-22
https://www.debian.org/security/2017/dsa-3771
https://www.debian.org/security/2017/dsa-3832
https://www.mozilla.org/security/advisories/mfsa2017-01/
https://www.mozilla.org/security/advisories/mfsa2017-02/
https://www.mozilla.org/security/advisories/mfsa2017-03/
http://rhn.redhat.com/errata/RHSA-2017-0190.html
http://rhn.redhat.com/errata/RHSA-2017-0238.html
http://www.securityfocus.com/bid/95769
http://www.securitytracker.com/id/1037693
https://bugzilla.mozilla.org/show_bug.cgi?id=1323338
https://bugzilla.mozilla.org/show_bug.cgi?id=1324716
https://security.gentoo.org/glsa/201702-13
https://security.gentoo.org/glsa/201702-22
https://www.debian.org/security/2017/dsa-3771
https://www.debian.org/security/2017/dsa-3832
https://www.mozilla.org/security/advisories/mfsa2017-01/
https://www.mozilla.org/security/advisories/mfsa2017-02/
https://www.mozilla.org/security/advisories/mfsa2017-03/