CVE-2023-6858: Buffer Overflow
Firefox was susceptible to a heap buffer overflow in nsTextFragment due to insufficient OOM handling.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2023-54/#CVE-2023-6858
Other sources
Firefox was susceptible to a heap buffer overflow in nsTextFragment due to insufficient OOM handling. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
— Launchpad
Firefox was susceptible to a heap buffer overflow in nsTextFragment due to insufficient OOM handling.
— Mozilla
Thunderbird was susceptible to a heap buffer overflow in nsTextFragment due to insufficient OOM handling.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 121 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 138.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.10.0esr-1~deb12u1Fixed in 128.9.0esr-2Fixed in 128.10.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:128.10.0esr-1~deb11u1Fixed in 1:128.8.0esr-1~deb12u1Fixed in 1:128.10.0esr-1~deb12u1Fixed in 1:128.9.0esr-1Fixed in 1:128.10.0esr-1 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.6
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6858?
CVE-2023-6858 is a critical vulnerability due to a heap buffer overflow in Firefox.
How do I fix CVE-2023-6858?
To fix CVE-2023-6858, upgrade Firefox or Thunderbird to version 115.6 or later.
Which versions of Firefox are affected by CVE-2023-6858?
CVE-2023-6858 affects Firefox versions prior to 115.6.
Is CVE-2023-6858 applicable to Thunderbird as well?
Yes, CVE-2023-6858 also affects Thunderbird prior to version 115.6.
What kind of impact does CVE-2023-6858 have if exploited?
If exploited, CVE-2023-6858 could allow remote attackers to execute arbitrary code.