{"cve":"CVE-2017-7832","nvd":{"published":"2018-06-11T21:29:11.483","modified":"2026-06-17T01:25:18.407","status":"Modified","description":"The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoofed in the addressbar by the dotless version of 'i' followed by the same accent as a second character with most font sets. This allows for domain spoofing attacks because these combined domain names do not display as punycode. This vulnerability affects Firefox < 57.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3},"cwes":["CWE-20"],"references":["http://www.securityfocus.com/bid/101832","http://www.securitytracker.com/id/1039803","https://bugzilla.mozilla.org/show_bug.cgi?id=1408782","https://www.mozilla.org/security/advisories/mfsa2017-24/","http://www.securityfocus.com/bid/101832"],"products":["mozilla:firefox"],"source":"nvd","synced_at":"2026-10-19T20:51:47.459859389+00:00"},"epss":{"cve":"CVE-2017-7832","score":0.01483,"percentile":0.73976,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}