Log in Start free

Vulnerability · Published Dec 19, 2023 · Assigned by mozilla

CVE-2023-6861

High 8.8

In plain English

A high-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.4%top 27.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox115.6.0-1.el8_9.almaALSA-2024:0012
AlmaLinux:9firefox115.6.0-1.el9_3.almaALSA-2024:0025
AlmaLinux:9firefox-x11115.6.0-1.el9_3.almaALSA-2024:0025
AlmaLinux:8thunderbird115.6.0-1.el8_9.almaALSA-2024:0003
AlmaLinux:9thunderbird115.6.0-1.el9_3.almaALSA-2024:0001
Alpine:v3.20firefox-esr115.6.0-r0ALPINE-CVE-2023-6861
Alpine:v3.21firefox-esr115.6.0-r0ALPINE-CVE-2023-6861
Alpine:v3.22firefox-esr115.6.0-r0ALPINE-CVE-2023-6861
Alpine:v3.23firefox-esr115.6.0-r0ALPINE-CVE-2023-6861
Debian:12firefox-esr115.6.0esr-1~deb12u1DEBIAN-CVE-2023-6861
Debian:12firefox-esr115.6.0esr-1~deb12u1DSA-5581-1
Debian:13firefox-esr115.6.0esr-1DEBIAN-CVE-2023-6861
Debian:14firefox-esr115.6.0esr-1DEBIAN-CVE-2023-6861
Debian:12thunderbird1:115.6.0-1~deb12u1DSA-5582-1
Debian:12thunderbird1:115.6.0-1~deb12u1DEBIAN-CVE-2023-6861
Debian:13thunderbird1:115.6.0-1DEBIAN-CVE-2023-6861
Debian:14thunderbird1:115.6.0-1DEBIAN-CVE-2023-6861
Rocky Linux:8firefox0:115.6.0-1.el8_9RLSA-2024:0012
Rocky Linux:8thunderbird0:115.6.0-1.el8_9RLSA-2024:0003
Ubuntu:22.04:LTSmozjs102no fix listedUBUNTU-CVE-2023-6861
Ubuntu:24.04:LTSmozjs102no fix listedUBUNTU-CVE-2023-6861
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2023-6861
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2023-6861
Ubuntu:22.04:LTSthunderbird1:115.6.0+build2-0ubuntu0.22.04.1USN-6563-1
Ubuntu:22.04:LTSthunderbird1:115.6.0+build2-0ubuntu0.22.04.1UBUNTU-CVE-2023-6861
Ubuntu:24.04:LTSthunderbird1:115.6.0+build2-0ubuntu1UBUNTU-CVE-2023-6861

Affected products (as reported)

VendorProductVersions
Mozilla Firefox ESR unspecified – before 115.6
Mozilla Thunderbird unspecified – before 115.6
Mozilla Firefox unspecified – before 121

References