CVE-2005-0238 Affecting epiphany-browser package, versions <1.4.8-2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-EPIPHANYBROWSER-518476
- published 2 May 2005
- disclosed 2 May 2005
Introduced: 2 May 2005
CVE-2005-0238 Open this link in a new tabHow to fix?
Upgrade Debian:11 epiphany-browser to version 1.4.8-2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream epiphany-browser package and not the epiphany-browser package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
References
- https://security-tracker.debian.org/tracker/CVE-2005-0238
- http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html
- http://www.shmoo.com/idn
- http://www.shmoo.com/idn/homograph.txt
- https://bugzilla.redhat.com/beta/show_bug.cgi?id=147399
- http://www.securityfocus.com/bid/12461
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19236