CVE-2023-6861

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Firefox ESR	>= unspecified, < 115.6
Mozilla	Thunderbird	>= unspecified, < 115.6
Mozilla	Firefox	>= unspecified, < 121

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1864118Issue Tracking, Permissions Required
https://lists.debian.org/debian-lts-announce/2023/12/msg00020.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00021.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202401-10Third Party Advisory
https://www.debian.org/security/2023/dsa-5581Third Party Advisory
https://www.debian.org/security/2023/dsa-5582Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-54/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-55/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-56/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1864118Issue Tracking, Permissions Required
https://lists.debian.org/debian-lts-announce/2023/12/msg00020.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00021.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202401-10Third Party Advisory
https://www.debian.org/security/2023/dsa-5581Third Party Advisory
https://www.debian.org/security/2023/dsa-5582Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-54/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-55/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-56/Vendor Advisory

Timeline

Published: Dec 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-68628.8A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affe CVE-2023-68638.8The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destr CVE-2023-68648.8Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption CVE-2023-68656.5`EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local CVE-2023-68668.8TypedArrays can be fallible and lacked proper exception handling. This could lead to abuse in other APIs which expect TypedArrays to always CVE-2023-68676.1The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission pro CVE-2023-68684.3In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one CVE-2023-68696.5A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to di CVE-2023-68704.3Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. *This CVE-2023-68714.3Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability CVE-2023-68726.5Browser tab titles were being leaked by GNOME to system logs. This could potentially expose the browsing habits of users running in a privat CVE-2023-68738.8Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so