Log in Start free

Vulnerability · Published Dec 19, 2023 · Assigned by mozilla

CVE-2023-6859

High 8.8

In plain English

A high-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.1%top 34.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox115.6.0-1.el8_9.almaALSA-2024:0012
AlmaLinux:9firefox115.6.0-1.el9_3.almaALSA-2024:0025
AlmaLinux:9firefox-x11115.6.0-1.el9_3.almaALSA-2024:0025
AlmaLinux:8thunderbird115.6.0-1.el8_9.almaALSA-2024:0003
AlmaLinux:9thunderbird115.6.0-1.el9_3.almaALSA-2024:0001
Alpine:v3.20firefox-esr115.6.0-r0ALPINE-CVE-2023-6859
Alpine:v3.21firefox-esr115.6.0-r0ALPINE-CVE-2023-6859
Alpine:v3.22firefox-esr115.6.0-r0ALPINE-CVE-2023-6859
Alpine:v3.23firefox-esr115.6.0-r0ALPINE-CVE-2023-6859
Debian:12firefox-esr115.6.0esr-1~deb12u1DEBIAN-CVE-2023-6859
Debian:12firefox-esr115.6.0esr-1~deb12u1DSA-5581-1
Debian:13firefox-esr115.6.0esr-1DEBIAN-CVE-2023-6859
Debian:14firefox-esr115.6.0esr-1DEBIAN-CVE-2023-6859
Debian:12thunderbird1:115.6.0-1~deb12u1DSA-5582-1
Debian:12thunderbird1:115.6.0-1~deb12u1DEBIAN-CVE-2023-6859
Debian:13thunderbird1:115.6.0-1DEBIAN-CVE-2023-6859
Debian:14thunderbird1:115.6.0-1DEBIAN-CVE-2023-6859
Rocky Linux:8firefox0:115.6.0-1.el8_9RLSA-2024:0012
Rocky Linux:8thunderbird0:115.6.0-1.el8_9RLSA-2024:0003
Ubuntu:22.04:LTSmozjs102no fix listedUBUNTU-CVE-2023-6859
Ubuntu:24.04:LTSmozjs102no fix listedUBUNTU-CVE-2023-6859
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2023-6859
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2023-6859
Ubuntu:22.04:LTSthunderbird1:115.6.0+build2-0ubuntu0.22.04.1USN-6563-1
Ubuntu:22.04:LTSthunderbird1:115.6.0+build2-0ubuntu0.22.04.1UBUNTU-CVE-2023-6859
Ubuntu:24.04:LTSthunderbird1:115.6.0+build2-0ubuntu1UBUNTU-CVE-2023-6859

Affected products (as reported)

VendorProductVersions
Mozilla Firefox ESR unspecified – before 115.6
Mozilla Thunderbird unspecified – before 115.6
Mozilla Firefox unspecified – before 121

References