CVE-2023-6208

Mozilla: Using Selection API would copy contents into X11 primary selection.

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard.
*This bug only affects Firefox on X11. Other systems are unaffected.* This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.

Al usar X11, el texto seleccionado por la página usando la API de selección se copiaba erróneamente en la selección principal, un almacenamiento temporal similar al portapapeles. *Este error sólo afecta a Thunderbird en X11. Otros sistemas no se ven afectados.* Esta vulnerabilidad afecta a Firefox < 120, Firefox < 115.5 y Thunderbird < 115.5.0.

The Mozilla Foundation Security Advisory describes this flaw as:

When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard.

*This bug only affects Firefox on X11. Other systems are unaffected.*

*Credits: turistu

CVSS Scores

NISTv3.1 8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-11-20 CVE Reserved
2023-11-21 CVE Published
2024-08-02 CVE Updated
2024-10-21 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-1021: Improper Restriction of Rendered UI Layers or Frames

CAPEC

References (8)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html	Mailing List
https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
https://www.debian.org/security/2023/dsa-5561	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.mozilla.org/security/advisories/mfsa2023-49	2023-11-30
https://www.mozilla.org/security/advisories/mfsa2023-50	2023-11-30
https://www.mozilla.org/security/advisories/mfsa2023-52	2023-11-30
https://access.redhat.com/security/cve/CVE-2023-6208	2023-11-29
https://bugzilla.redhat.com/show_bug.cgi?id=2250900	2023-11-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				< 120.0 Search vendor "Mozilla" for product "Firefox" and version " < 120.0"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				< 115.5.0 Search vendor "Mozilla" for product "Firefox Esr" and version " < 115.5.0"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				< 115.5 Search vendor "Mozilla" for product "Thunderbird" and version " < 115.5"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				12.0 Search vendor "Debian" for product "Debian Linux" and version "12.0"		-		Affected