CVE-2005-0235

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The International Domain Name (IDN) support in Opera 7.54 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.htmlBroken Link, Exploit, Vendor Advisory
http://marc.info/?l=bugtraq&m=110782704923280&w=2Mailing List
http://www.novell.com/linux/security/advisories/2005_31_opera.htmlBroken Link
http://www.securityfocus.com/bid/12461Broken Link, Third Party Advisory, VDB Entry
http://www.shmoo.com/idnBroken Link, Exploit
http://www.shmoo.com/idn/homograph.txtBroken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/19236Third Party Advisory, VDB Entry
http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.htmlBroken Link, Exploit, Vendor Advisory
http://marc.info/?l=bugtraq&m=110782704923280&w=2Mailing List
http://www.novell.com/linux/security/advisories/2005_31_opera.htmlBroken Link
http://www.securityfocus.com/bid/12461Broken Link, Third Party Advisory, VDB Entry
http://www.shmoo.com/idnBroken Link, Exploit
http://www.shmoo.com/idn/homograph.txtBroken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/19236Third Party Advisory, VDB Entry

Timeline

Published: May 2, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-02365.0The International Domain Name (IDN) support in Omniweb 5 allows remote attackers to spoof domain names using punycode encoded domain names t CVE-2005-02375.0The International Domain Name (IDN) support in Konqueror 3.2.1 on KDE 3.2.1 allows remote attackers to spoof domain names using punycode enc CVE-2005-02385.0The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names th CVE-2005-02397.5viewcert.php in the S/MIME plugin 0.4 and 0.5 for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacter CVE-2005-02407.2Format string vulnerability in chdev on IBM AIX 5.2 allows local users to execute arbitrary code via format string specifiers in a command l CVE-2005-02415.0The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling CVE-2005-02424.6The Audio Setup Wizard (asw.dll) in Yahoo! Messenger 6.0.0.1750, and possibly other versions, allows attackers to arbitrary code by placing CVE-2005-02435.0Yahoo! Messenger 6.0.0.1750, and possibly other versions before 6.0.0.1921, does not properly display long filenames in file dialog boxes, w CVE-2005-02446.5PostgreSQL 8.0.0 and earlier allows local users to bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command.CVE-2005-02457.5Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large number of arguments to CVE-2005-02465.0The intagg contrib module for PostgreSQL 8.0.0 and earlier allows attackers to cause a denial of service (crash) via crafted arrays.CVE-2005-02476.5Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via (1) a large number of