Lucene search

PRIOn knowledge basePRION:CVE-2023-6856

HistoryDec 19, 2023 - 2:15 p.m.

Heap overflow

2023-12-1914:15:00

PRIOn knowledge base

www.prio-n.com

webgl

drawelementsinstanced

heap overflow

vulnerability

firefox esr

thunderbird

remote code execution

sandbox escape

mesa vm driver

7.7 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.4%

JSON

The WebGL DrawElementsInstanced method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

CPENameOperatorVersion
debian_linuxeq10.0
debian_linuxeq11.0
debian_linuxeq12.0
firefoxlt121.0
firefox_esrlt115.6
thunderbirdlt115.6

Name	Operator	Version
debian_linux	eq	10.0
debian_linux	eq	11.0
debian_linux	eq	12.0
firefox	lt	121.0
firefox_esr	lt	115.6
thunderbird	lt	115.6

References

bugzilla.mozilla.org/show_bug.cgi?id=1843782

lists.debian.org/debian-lts-announce/2023/12/msg00020.html

lists.debian.org/debian-lts-announce/2023/12/msg00021.html

security.gentoo.org/glsa/202401-10

www.debian.org/security/2023/dsa-5581

www.debian.org/security/2023/dsa-5582

www.mozilla.org/security/advisories/mfsa2023-54/

www.mozilla.org/security/advisories/mfsa2023-55/

www.mozilla.org/security/advisories/mfsa2023-56/