Unscored severity · published May 2, 2005
CVE-2005-0238
The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL…
–
CVSS
1.6%
EPSS
No
On KEV
Description
The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Camino · Mozilla
0.8.5 · source: NVD
EP
Epiphany · Gnome
All versions, or not specified · source: NVD
MO
Mozilla · Mozilla
through 1.6 · source: NVD
OM
Omniweb · Omnigroup
5 · source: NVD
OB
Opera Browser · Opera
through 7.54 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0238
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0238
Exploit
http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html
Broken Link
http://www.securityfocus.com/bid/12461
Broken Link
http://www.shmoo.com/idn
Broken Link
http://www.shmoo.com/idn/homograph.txt
Broken Link
https://bugzilla.redhat.com/beta/show_bug.cgi?id=147399
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/19236
More from Epiphany
8.1
CVE-2019-6251
WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections
7.5
CVE-2023-26081
In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts
7.5
CVE-2022-29536
In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title
7.5
CVE-2018-12016
libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write…
7.5
CVE-2018-11396
ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that…