Vulnerability Description
Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 7.0 |
| Mozilla | Firefox | < 52.4.0 |
| Mozilla | Thunderbird | < 52.4.0 |
| Apple | Mac Os X | All versions |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/101059Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039465Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1390980Issue TrackingThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1393624Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/11/msg00000.htmlThird Party Advisory
- https://security.gentoo.org/glsa/201803-14Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-21/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-22/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-23/Vendor Advisory
- http://www.securityfocus.com/bid/101059Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039465Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1390980Issue TrackingThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1393624Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/11/msg00000.htmlThird Party Advisory
- https://security.gentoo.org/glsa/201803-14Third Party Advisory
FAQ
What is CVE-2017-7825?
CVE-2017-7825 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only ...
How severe is CVE-2017-7825?
CVE-2017-7825 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-7825?
Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Mozilla Firefox, Mozilla Thunderbird, Apple Mac Os X.