Default fonts on OS X display some Tibetan characters as whitespace.

published 2018-06-11 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-16738

cvss: 5.3; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

Patch / fix

fixed in 3 distros 2

Mozilla Firefox 54
Mozilla Firefox ESR 52.2
Mozilla Thunderbird 52.2

suse opensuse

mozilla-nss SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +3 more 3.29.5-47.3.2
firefox-gcc5 SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +2 more 5.3.1+r233831-7.1
MozillaFirefox SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +3 more 52.2.0esr-72.5.2
firefox-libffi-gcc5 SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +2 more 5.3.1+r233831-7.1
MozillaFirefox-branding-SLED SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +2 more 52-24.3.44
MozillaFirefox-branding-SLE SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES for SAP 12 +6 more 52-31.1
MozillaFirefox SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES for SAP 12 +7 more 52.2.0esr-108.3

suse advisories SUSE-SU-2017:2235-1 SUSE-SU-2017:1669-1

MozillaThunderbird openSUSE Tumbleweed 91.1.1-1.1
MozillaThunderbird Package Hub 12 52.2-36.1

opensuse advisories openSUSE-SU-2024:10601-1 openSUSE-SU-2017:1579-1

Exploit prediction

1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

Mozilla Firefox
Mozilla Firefox ESR
Mozilla Thunderbird

Classification

Weakness

CWE-20 Improper Input Validation

References

mozilla.org /security/advisories/mfsa2017-15/
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=1360309
issue-tracking, vendor-advisory
mozilla.org /security/advisories/mfsa2017-17/
vendor-advisory
mozilla.org /security/advisories/mfsa2017-16/
vendor-advisory
securityfocus.com /bid/99057
vdb-entry, third-party-advisory
securitytracker.com /id/1038689
vdb-entry, third-party-advisory

Sources

CVE List CVE-2017-7763
NVD CVE-2017-7763

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary