SB2017012627 - Input validation error in firefox-esr (Alpine package)
Published: January 26, 2017
Security Bulletin ID
SB2017012627
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2017-5383)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
Remediation
Install update from vendor's website.