CVE-2023-6856
high · 8.8The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
8.8
CVSS
20.6%
EPSS (exploit prob.)
97th
EPSS percentile
2023-12-19
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-787
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | firefox | < 121.0 |
| mozilla | firefox_esr | < 115.6 |
| mozilla | thunderbird | < 115.6 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| debian | debian_linux | 12.0 |
Check a specific version with /api/v1/cve/match.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1843782
- https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html
- https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
- https://security.gentoo.org/glsa/202401-10
- https://www.debian.org/security/2023/dsa-5581
- https://www.debian.org/security/2023/dsa-5582
- https://www.mozilla.org/security/advisories/mfsa2023-54/
- https://www.mozilla.org/security/advisories/mfsa2023-55/
- https://www.mozilla.org/security/advisories/mfsa2023-56/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1843782
- https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html
- https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
- https://security.gentoo.org/glsa/202401-10
- https://www.debian.org/security/2023/dsa-5581
- https://www.debian.org/security/2023/dsa-5582
- https://www.mozilla.org/security/advisories/mfsa2023-54/
- https://www.mozilla.org/security/advisories/mfsa2023-55/
- https://www.mozilla.org/security/advisories/mfsa2023-56/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2023-6856