CVE-2023-6857

Опубликовано: 19 дек. 2023

Источник: nvd

CVSS3: 5.3

EPSS Низкий

Описание

When resolving a symlink, a race may occur where the buffer passed to readlink may actually be smaller than necessary. This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

Ссылки

https://bugzilla.mozilla.org/show_bug.cgi?id=1796023
Issue Tracking
Permissions Required
https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202401-10
Third Party Advisory
https://www.debian.org/security/2023/dsa-5581
Third Party Advisory
https://www.debian.org/security/2023/dsa-5582
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-54/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-55/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-56/
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1796023
Issue Tracking
Permissions Required
https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202401-10
Third Party Advisory
https://www.debian.org/security/2023/dsa-5581
Third Party Advisory
https://www.debian.org/security/2023/dsa-5582
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-54/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-55/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-56/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

Версия до 121.0 (исключая)

cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*

Версия до 115.6 (исключая)

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Версия до 115.6 (исключая)

Одно из

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

EPSS

Процентиль: 46%

0.00235

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-362

Связанные уязвимости

CVE-2023-6857

CVSS3: 5.3

ubuntu

больше 1 года назад

When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

CVE-2023-6857

CVSS3: 6.1

redhat

больше 1 года назад

CVE-2023-6857

CVSS3: 5.3

debian

больше 1 года назад

When resolving a symlink, a race may occur where the buffer passed to ...

GHSA-8fq6-p869-285x

CVSS3: 5.3

github

больше 1 года назад

BDU:2023-09031

CVSS3: 6.1

fstec

больше 1 года назад

Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с нарушением начальной границы буфера, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность данных

EPSS

Процентиль: 46%

0.00235

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-362