CVE-2023-6212

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 120
Mozilla	Firefox ESR	>= unspecified, < 115.5.0
Mozilla	Thunderbird	>= unspecified, < 115.5

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1658432%2C1820983%2C1829252%2C1856072%2C1856091%2C1859030%2C1860943%2C1862782Broken Link
https://lists.debian.org/debian-lts-announce/2023/11/msg00017.htmlMailing List
https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
https://www.debian.org/security/2023/dsa-5561Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-49/Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-50/Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-52/Release Notes, Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1658432%2C1820983%2C1829252%2C1856072%2C1856091%2C1859030%2C1860943%2C1862782Broken Link
https://lists.debian.org/debian-lts-announce/2023/11/msg00017.htmlMailing List
https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
https://www.debian.org/security/2023/dsa-5561Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-49/Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-50/Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-52/Release Notes, Vendor Advisory

Timeline

Published: Nov 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-62138.8Memory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2023-62147.5The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and CVE-2023-62157.2A potential security vulnerability has been identified in HP Sure Start’s protection of the Intel Flash Descriptor in certain HP PC products CVE-2023-62176.1In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scrip CVE-2023-62187.2In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path CVE-2023-62197.2The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'bookingpress_proce CVE-2023-62209.8The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetforms CVE-2023-62216.5The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic contro CVE-2023-62227.2IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with a CVE-2023-62234.3The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the CVE-2023-62255.4The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta sh CVE-2023-62264.3The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,