CVE-2023-6859: Use After Free
A use-after-free condition affected TLS socket creation when under memory pressure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 121 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 138.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.10.0esr-1~deb12u1Fixed in 128.9.0esr-2Fixed in 128.10.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:128.10.0esr-1~deb11u1Fixed in 1:128.8.0esr-1~deb12u1Fixed in 1:128.10.0esr-1~deb12u1Fixed in 1:128.9.0esr-1Fixed in 1:128.10.0esr-1 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 115.6.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6859?
CVE-2023-6859 has been classified as a high severity vulnerability due to its potential to allow an attacker to exploit a use-after-free condition.
How do I fix CVE-2023-6859?
To fix CVE-2023-6859, update Mozilla Firefox or Thunderbird to version 115.6 or later.
What software is affected by CVE-2023-6859?
CVE-2023-6859 affects Mozilla Firefox ESR and Thunderbird versions prior to 115.6, as well as certain versions of Firefox up to 121.
What does a use-after-free vulnerability like CVE-2023-6859 entail?
A use-after-free vulnerability like CVE-2023-6859 occurs when a program continues to use a pointer after the memory it points to has been freed, leading to potential memory corruption.
Can CVE-2023-6859 be exploited remotely?
Yes, CVE-2023-6859 can potentially be exploited remotely if a user is misled into loading a malicious site that triggers the vulnerability.