PT-2017-3990 · Mozilla+2 · Firefox Esr+4

Khalil Zhani · Published 2017-08-24 · Updated 2024-12-12 · CVE-2017-7825

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 56 Firefox ESR versions prior to 52.4 Thunderbird versions prior to 52.4

Description The issue is related to insufficient input validation, which can be exploited by a remote attacker to conduct spoofing attacks. Specifically, certain fonts on OS X display some Tibetan and Arabic characters as whitespace, allowing for domain name spoofing attacks when used in the address bar as part of an IDN. This issue only affects OS X operating systems.

Recommendations For Firefox versions prior to 56, update to version 56 or later to resolve the issue. For Firefox ESR versions prior to 52.4, update to version 52.4 or later to resolve the issue. For Thunderbird versions prior to 52.4, update to version 52.4 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-2358

ALT-PU-2017-2437

BDU:2021-00025

CVE-2017-7825

MGASA-2018-0018

OPENSUSE-SU-2017:2707-1

OPENSUSE-SU-2017:2710-1

OPENSUSE-SU-2017_2710-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:10601-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2017:2688-1

SUSE-SU-2017:2872-1

SUSE-SU-2017:2872-2

Affected Products

Alt Linux

Firefox

Firefox Esr

Suse

Thunderbird

References · 1991

• https://advisories.mageia.org/MGASA-2018-0018.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2017:2710-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2688-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2017-21 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7825 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-19 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00025 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=1212483 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-12 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-05 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10601-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201803-14 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2872-2 · Vendor Advisory