CVE-2017-7825 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input Validation5 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
1.7%
top 17.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird+3 more
Timeline
PublishedJun 11
Latest updateMay 14

Description

Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages7 packages

▶CVEListV5mozilla/firefoxunspecified — 56
▶NVDmozilla/firefox< 52.4.0+1
▶CVEListV5mozilla/firefox_esrunspecified — 52.4

Also affects: Debian Linux 7.0

🔴Vulnerability Details

1
GHSA
GHSA-3mv8-qr3m-89rv: Several fonts on OS X display some Tibetan and Arabic characters as whitespace↗2022-05-14
▶

📋Vendor Advisories

2
Red Hat
Mozilla: OS X fonts render some Tibetan and Arabic unicode characters as spaces (MFSA 2017-22)↗2017-09-28
▶
Debian
CVE-2017-7825: firefox - Several fonts on OS X display some Tibetan and Arabic characters as whitespace. ...↗2017
▶

💬Community

1
Bugzilla
CVE-2017-7825 Mozilla: OS X fonts render some Tibetan and Arabic unicode characters as spaces (MFSA 2017-22)↗2017-09-28
▶