CVE-2023-6857: Race Condition

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1796023
• https://www.mozilla.org/security/advisories/mfsa2023-54/
• https://www.mozilla.org/security/advisories/mfsa2023-55/
• https://www.mozilla.org/security/advisories/mfsa2023-56/
• https://www.debian.org/security/2023/dsa-5581
• https://www.debian.org/security/2023/dsa-5582
• https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html
• https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
• https://security.gentoo.org/glsa/202401-10
• https://launchpad.net/bugs/cve/CVE-2023-6857
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6857
• https://access.redhat.com/errata/RHSA-2024:0001
• https://access.redhat.com/errata/RHSA-2024:0002
• https://access.redhat.com/errata/RHSA-2024:0004
• https://access.redhat.com/errata/RHSA-2024:0005
• https://access.redhat.com/errata/RHSA-2024:0012
• https://access.redhat.com/errata/RHSA-2024:0011
• https://access.redhat.com/errata/RHSA-2024:0019
• https://access.redhat.com/errata/RHSA-2024:0025
• https://access.redhat.com/errata/RHSA-2024:0021
• https://access.redhat.com/errata/RHSA-2024:0024
• https://access.redhat.com/errata/RHSA-2024:0022
• https://access.redhat.com/errata/RHSA-2024:0003
• https://access.redhat.com/errata/RHSA-2024:0023
• https://access.redhat.com/errata/RHSA-2024:0026
• https://access.redhat.com/errata/RHSA-2024:0028
• https://access.redhat.com/errata/RHSA-2024:0030
• https://access.redhat.com/errata/RHSA-2024:0029
• https://access.redhat.com/errata/RHSA-2024:0027
• https://bugzilla.redhat.com/show_bug.cgi?id=2255362
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-56/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-56/#CVE-2023-6857
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-55/#CVE-2023-6857
• https://security-tracker.debian.org/tracker/CVE-2023-6857
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6857
• https://nvd.nist.gov/vuln/detail/CVE-2023-6857
• https://ubuntu.com/security/CVE-2023-6857

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2023-55
• MFSA2023-56
• MFSA2023-54

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2023-50762
• CVE-2023-50761
• CVE-2023-6856
• CVE-2023-6857
• CVE-2023-6858
• CVE-2023-6859
• CVE-2023-6860
• CVE-2023-6861
• CVE-2023-6862
• CVE-2023-6863
• CVE-2023-6864
• CVE-2023-6135
• CVE-2023-6865
• CVE-2023-6866
• CVE-2023-6867
• CVE-2023-6868
• CVE-2023-6869
• CVE-2023-6870
• CVE-2023-6871
• CVE-2023-6872
• CVE-2023-6873

Frequently Asked Questions

• What is the severity of CVE-2023-6857?

  CVE-2023-6857 is classified as a medium severity vulnerability, primarily affecting Firefox on Unix-based systems.

• How do I fix CVE-2023-6857?

  To fix CVE-2023-6857, update Firefox or Thunderbird to version 115.6 or later.

• Which software is affected by CVE-2023-6857?

  CVE-2023-6857 affects Firefox ESR, Mozilla Firefox, Thunderbird, and their respective package versions below 115.6.

• On which operating systems does CVE-2023-6857 have an impact?

  CVE-2023-6857 impacts Unix-based operating systems, including Android, Linux, and MacOS, while Windows is unaffected.

• Is there a workaround for CVE-2023-6857?

  Currently, the best approach for mitigating CVE-2023-6857 is to apply the recommended software updates.