CVE-2023-6867: debian debian_linux
Vulnerability summary
CVE-2023-6867 is a medium (CVSS 6.1) vulnerability in debian debian_linux. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 18 · Related 7Timeline
- 19-12-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.68%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.68% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu7 products
- firefox< 121.0+build1-0ubuntu0.20.04.1
- mozjs102All versions (No fix recorded)
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
Debian2 products
- firefox-esr< 115.6.0esr-1~deb12u1 | < 115.6.0esr-1
- debian_linuxEOL10.0 | 11.0 | 12.0
Mozilla2 products
- firefox≥ unspecified, < 121 | < 121.0
- firefox_esr≥ unspecified, < 115.6 | < 115.6
Chainguard1 product
- firefox-esr< 121.0-r0
4 vendors · 12 products
