CVE-2023-6864: High severity Mozilla Thunderbird vulnerability
Last updated 24 July 2024
Other sources
Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 121 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 138.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.10.0esr-1~deb12u1Fixed in 128.10.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:128.10.0esr-1~deb11u1Fixed in 1:128.8.0esr-1~deb12u1Fixed in 1:128.10.0esr-1~deb12u1Fixed in 1:128.10.0esr-1 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 115.6.0-r0 - Upgrade
Upgrade
alpine/mozjsto a version that resolves this vulnerability.Fixed in 115.6.0-r0 - Upgrade
Upgrade
alpine/mozjs115to a version that resolves this vulnerability.Fixed in 115.6.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6864?
CVE-2023-6864 is classified as a memory safety vulnerability that could potentially allow arbitrary code execution.
How do I fix CVE-2023-6864?
To mitigate CVE-2023-6864, update to Firefox version 121 or Firefox ESR and Thunderbird version 115.6 or later.
What software is affected by CVE-2023-6864?
CVE-2023-6864 affects Firefox versions up to 121, Firefox ESR versions up to 115.6, and Thunderbird versions up to 115.6.
Can CVE-2023-6864 be exploited remotely?
While CVE-2023-6864 shows evidence of memory corruption, exploitation would require significant effort and is not guaranteed.
When was CVE-2023-6864 disclosed?
CVE-2023-6864 was disclosed on July 24, 2024.