Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2023-6209: Firefox and Thunderbird can be misdirected to other sites
CVE-2023-6209 · published 2 years ago
Summary
Older versions of Firefox and Thunderbird may misinterpret specially crafted web addresses, allowing attackers to change the destination host. This could let malicious sites appear as trusted ones, potentially exposing users to phishing or data theft. Update the browsers to the latest versions to prevent this risk.
What to do
- Update debian firefox-esr to version 115.5.0esr-1~deb12u1.
- Update debian firefox-esr to version 115.5.0esr-1.
- Update debian thunderbird to version 1:115.5.0-1~deb12u1.
- Update debian thunderbird to version 1:115.5.0-1.
- Update mozilla firefox to version 120.0 or later.
- Update mozilla firefox_esr to version 115.5.0 or later.
- Update mozilla thunderbird to version 115.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 115.5.0esr-1~deb12u1 Fix: upgrade to 115.5.0esr-1~deb12u1
|
| Debian:13 | debian | firefox-esr |
< 115.5.0esr-1 Fix: upgrade to 115.5.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 115.5.0esr-1 Fix: upgrade to 115.5.0esr-1
|
| Debian:12 | debian | thunderbird |
< 1:115.5.0-1~deb12u1 Fix: upgrade to 1:115.5.0-1~deb12u1
|
| Debian:13 | debian | thunderbird |
< 1:115.5.0-1 Fix: upgrade to 1:115.5.0-1
|
| Debian:14 | debian | thunderbird |
< 1:115.5.0-1 Fix: upgrade to 1:115.5.0-1
|
| – | mozilla | firefox |
< 120.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| – | mozilla | firefox_esr |
< 115.5.0 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
| – | mozilla | thunderbird |
< 115.5 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 11.0 12.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
Original advisory text
Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security probl...
Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.
References
- https://security-tracker.debian.org/tracker/CVE-2023-6209 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1858570 Issue Tracking Permissions Required
- https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html Mailing List
- https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
- https://www.debian.org/security/2023/dsa-5561 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-49/ Release Notes Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-50/ Release Notes Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-52/ Release Notes Vendor Advisory
Severity
6.5
Medium
Type
CWE-22Path Traversal
Timeline
Published21 Nov 2023
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta