CVE-2017-7763 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input Validation4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.5%
top 33.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird+3 more
Timeline
PublishedJun 11
Latest updateMay 14

Description

Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages7 packages

▶CVEListV5mozilla/firefoxunspecified — 54
▶NVDmozilla/firefox< 52.2.0+1
▶CVEListV5mozilla/firefox_esrunspecified — 52.2

Also affects: Debian Linux 8.0, 9.0

🔴Vulnerability Details

1
GHSA
GHSA-2m94-7q7f-58gc: Default fonts on OS X display some Tibetan characters as whitespace↗2022-05-14
▶

💥Exploits & PoCs

1
Exploit-DB
Asterisk 13.17.2 - 'chan_skinny' Remote Memory Corruption↗2018-02-07
▶

📋Vendor Advisories

1
Debian
CVE-2017-7763: firefox - Default fonts on OS X display some Tibetan characters as whitespace. When used i...↗2017
▶