CVE-2023-6859

Una condición de use after free afectó la creación de sockets TLS cuando estaba bajo presión de memoria. Esta vulnerabilidad afecta a Firefox ESR <115.6, Thunderbird <115.6 y Firefox <121.

The Mozilla Foundation Security Advisory describes this flaw as: A use-after-free condition affected TLS socket creation when under memory pressure.

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code. Marcus Brinkmann discovered that Thunderbird did not properly parse a PGP/MIME payload that contains digitally signed text. An attacker could potentially exploit this issue to spoof an email message.