#VU7095 Information disclosure in Firefox ESR - CVE-2017-7763

Vulnerability identifier: #VU7095

Vulnerability risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-7763

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Firefox ESR
Client/Desktop applications / Web browsers

Vendor: Mozilla

Description
The vulnerability allows a remote attacker to perform spoofing attack.

The weakness exists due to displaying of some Tibetan characters as whitespace by default fonts on OS X. A remote attacker can use characters in the addressbar as part of an IDN to perform domain name spoofing attacks and read arbitrary files.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation
Update to version 52.2.

Vulnerable software versions

Firefox ESR: 38.0 - 38.8.0, 45.0 - 45.8, 52.0.1

---

External links
https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.