PT-2018-8426 · Mozilla+3 · Firefox Esr+5

Michał Bentkowski · Published 2017-06-16 · Updated 2024-06-15 · CVE-2017-7763

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 54 Firefox ESR versions prior to 52.2 Thunderbird versions prior to 52.2

Description The issue affects the display of certain Tibetan characters in the address bar on OS X operating systems, potentially leading to domain name spoofing attacks. This is due to the default fonts on OS X displaying some Tibetan characters as whitespace. The estimated number of potentially affected devices is not specified.

Recommendations For Firefox versions prior to 54, update to version 54 or later. For Firefox ESR versions prior to 52.2, update to version 52.2 or later. For Thunderbird versions prior to 52.2, update to version 52.2 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-1770

ALT-PU-2017-1777

ALT-PU-2017-1886

CVE-2017-7763

MGASA-2017-0180

MGASA-2018-0018

OPENSUSE-SU-2017:1579-1

OPENSUSE-SU-2024:10601-1

SUSE-SU-2017:1669-1

SUSE-SU-2017:2235-1

Affected Products

Alt Linux

Firefox

Firefox Esr

Os X

Suse

Thunderbird

References · 465

• https://nvd.nist.gov/vuln/detail/CVE-2017-7763 · Security Note
• https://advisories.mageia.org/MGASA-2018-0018.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2017:1579-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0018 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-22 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0180.html · Security Note
• https://mozilla.org/security/advisories/mfsa2017-16 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0180 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-19 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-16 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2017-15 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1360309 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-28 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2017-17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2235-1 · Vendor Advisory