CVE-2023-6867: Medium severity Mozilla Firefox vulnerability
Last updated 24 July 2024
Other sources
The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 121 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 138.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.10.0esr-1~deb12u1Fixed in 128.9.0esr-2Fixed in 128.10.0esr-1 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 115.6 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 115.6.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2023-6867?
CVE-2023-6867 has been assigned a severity that indicates it poses a risk of user deception through clickjacking.
How do I fix CVE-2023-6867?
To mitigate CVE-2023-6867, users should update their Firefox or Thunderbird software to versions 115.14.0esr or later for Debian and version 134.0.2-2 or later for other distributions.
Which software versions are affected by CVE-2023-6867?
CVE-2023-6867 affects Firefox versions up to 115.6, Thunderbird versions up to 115.6, and Firefox ESR versions up to 115.6.
What is the nature of the vulnerability in CVE-2023-6867?
CVE-2023-6867 is a clickjacking vulnerability that tricks users into unintentionally interacting with a UI element.
Is there a workaround for CVE-2023-6867?
While the best solution is to update the software, users can minimize risk by avoiding suspicious links and verifying application behavior before clicking.