The vulnerability of Firefox browsers, Firefox ESR, and the Thunderbird email client arises from the mixing of symbols from the “Canadian Syllabics” block with symbols from other blocks, allowing attackers to perform spear-phishing attacks.

🗓️ 13 Jan 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Canadian Syllabics mixed with other symbols enables spear-phishing in Firefox ESR and Thunderbird.

Reporter	Title	Published	Views	Family All 125
FreeBSD	mozilla -- multiple vulnerabilities	13 Jun 201700:00	–	freebsd
Tenable Nessus	Mozilla Firefox < 54 Multiple Vulnerabilities	14 Jun 201700:00	–	nessus
Tenable Nessus	CentOS 6 / 7 : firefox (CESA-2017:1440)	16 Jun 201700:00	–	nessus
Tenable Nessus	CentOS 6 / 7 : thunderbird (CESA-2017:1561)	22 Jun 201700:00	–	nessus
Tenable Nessus	Debian DLA-1007-1 : icedove/thunderbird security update	5 Jul 201700:00	–	nessus
Tenable Nessus	Debian DLA-991-1 : firefox-esr security update	19 Jun 201700:00	–	nessus
Tenable Nessus	Debian DSA-3881-1 : firefox-esr - security update	15 Jun 201700:00	–	nessus
Tenable Nessus	Debian DSA-3918-1 : icedove - security update	27 Jul 201700:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP1 : firefox (EulerOS-SA-2017-1126)	21 Jul 201700:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1127)	21 Jul 201700:00	–	nessus

Vulners

Node

mozilla firefoxRange<54

OR

mozilla firefox_esrRange<52.2

OR

mozilla thunderbirdRange<52.2

OR

red_hat red_hat_enterprise_linuxMatch6

OR

red_hat red_hat_enterprise_linuxMatch7

OR

canonical ubuntuMatch17.04

OR

canonical ubuntuMatch16.10

OR

novell opensuse_leapMatch42.2

OR

novell opensuse_leapMatch42.3

OR

novell opensuse_leapMatch15.0

OR

novell suse_linux_enterprise_serverMatch12-ltss

OR

novell suse_linux_enterprise_server_for_sap_applicationsMatch12-ltss

OR

novell suse_linux_enterprise_server_for_sap_applicationsMatch12

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-7764
security-tracker	www.security-tracker.debian.org/tracker/CVE-2017-7764
bugzilla	www.bugzilla.mozilla.org/show_bug.cgi
mozilla	www.mozilla.org/security/advisories/mfsa2017-15/
mozilla	www.mozilla.org/security/advisories/mfsa2017-16/
mozilla	www.mozilla.org/security/advisories/mfsa2017-17/
debian	www.debian.org/security/2017/dsa-3881
debian	www.debian.org/security/2017/dsa-3918
access	www.access.redhat.com/security/cve/cve-2017-7764
suse	www.suse.com/security/cve/CVE-2017-7764/

13 Jan 2021 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 25

CVSS 35.3

EPSS0.02002

spear phishing canadian syllabics symbol mixing firefox esr thunderbird client