CVE-2023-6857

When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

History

21 Nov 2024, 08:44

Type Values Removed Values Added
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1796023 - Issue Tracking, Permissions Required () https://bugzilla.mozilla.org/show_bug.cgi?id=1796023 - Issue Tracking, Permissions Required
References () https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html - Mailing List, Third Party Advisory
References () https://security.gentoo.org/glsa/202401-10 - Third Party Advisory () https://security.gentoo.org/glsa/202401-10 - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5581 - Third Party Advisory () https://www.debian.org/security/2023/dsa-5581 - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5582 - Third Party Advisory () https://www.debian.org/security/2023/dsa-5582 - Third Party Advisory
References () https://www.mozilla.org/security/advisories/mfsa2023-54/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2023-54/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2023-55/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2023-55/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2023-56/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2023-56/ - Vendor Advisory

02 Feb 2024, 02:32

Type Values Removed Values Added
References () https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html - () https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html - Mailing List, Third Party Advisory
References () https://security.gentoo.org/glsa/202401-10 - () https://security.gentoo.org/glsa/202401-10 - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html - () https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html - Mailing List, Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

07 Jan 2024, 11:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202401-10 -

29 Dec 2023, 12:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html -
  • () https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html -

22 Dec 2023, 11:09

Type Values Removed Values Added
CPE cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
CWE CWE-362
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.3
References () https://www.mozilla.org/security/advisories/mfsa2023-56/ - () https://www.mozilla.org/security/advisories/mfsa2023-56/ - Vendor Advisory
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1796023 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1796023 - Issue Tracking, Permissions Required
References () https://www.debian.org/security/2023/dsa-5581 - () https://www.debian.org/security/2023/dsa-5581 - Third Party Advisory
References () https://www.mozilla.org/security/advisories/mfsa2023-55/ - () https://www.mozilla.org/security/advisories/mfsa2023-55/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2023-54/ - () https://www.mozilla.org/security/advisories/mfsa2023-54/ - Vendor Advisory
References () https://www.debian.org/security/2023/dsa-5582 - () https://www.debian.org/security/2023/dsa-5582 - Third Party Advisory
First Time Mozilla firefox Esr
Apple
Mozilla thunderbird
Google android
Linux
Mozilla firefox
Mozilla
Google
Apple macos
Debian debian Linux
Linux linux Kernel
Debian

22 Dec 2023, 01:15

Type Values Removed Values Added
References
  • () https://www.debian.org/security/2023/dsa-5582 -

21 Dec 2023, 01:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-12-19 14:15

Updated : 2024-11-21 08:44


NVD link : CVE-2023-6857

Mitre link : CVE-2023-6857

CVE.ORG link : CVE-2023-6857


JSON object : View

Products Affected

mozilla

  • firefox
  • thunderbird
  • firefox_esr

apple

  • macos

linux

  • linux_kernel

google

  • android

debian

  • debian_linux
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')