CVE-2023-6856
Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM driver
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
El método WebGL `DrawElementsInstanced` era susceptible a un desbordamiento de búfer cuando se usaba en sistemas con el controlador Mesa VM. Este problema podría permitir a un atacante realizar la ejecución remota de código y escapar de la zona de pruebas. Esta vulnerabilidad afecta a Firefox ESR <115.6, Thunderbird <115.6 y Firefox <121.
The Mozilla Foundation Security Advisory describes this flaw as:
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-12-15 CVE Reserved
- 2023-12-19 CVE Published
- 2024-02-02 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-122: Heap-based Buffer Overflow
- CWE-787: Out-of-bounds Write
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html | Mailing List |
|
| https://security.gentoo.org/glsa/202401-10 | Third Party Advisory |
|
| https://www.debian.org/security/2023/dsa-5581 | Third Party Advisory |
|
| https://www.debian.org/security/2023/dsa-5582 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.mozilla.org/security/advisories/mfsa2023-54 | 2024-02-02 | |
| https://www.mozilla.org/security/advisories/mfsa2023-55 | 2024-02-02 | |
| https://www.mozilla.org/security/advisories/mfsa2023-56 | 2024-02-02 | |
| https://access.redhat.com/security/cve/CVE-2023-6856 | 2024-01-02 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2255360 | 2024-01-02 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | < 121.0 Search vendor "Mozilla" for product "Firefox" and version " < 121.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | < 115.6 Search vendor "Mozilla" for product "Firefox Esr" and version " < 115.6" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 115.6 Search vendor "Mozilla" for product "Thunderbird" and version " < 115.6" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 12.0 Search vendor "Debian" for product "Debian Linux" and version "12.0" | - |
Affected
| ||||||