Lucene search

PRIOn knowledge basePRION:CVE-2023-6860

HistoryDec 19, 2023 - 2:15 p.m.

Code injection

2023-12-1914:15:00

PRIOn knowledge base

www.prio-n.com

code injection

videobridge

remote decoders

sandbox escape

vulnerability

firefox esr

thunderbird

firefox

6.2 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

31.8%

JSON

The VideoBridge allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

CPENameOperatorVersion
debian_linuxeq10.0
debian_linuxeq11.0
debian_linuxeq12.0
firefoxlt121.0
firefox_esrlt115.6
thunderbirdlt115.6

Name	Operator	Version
debian_linux	eq	10.0
debian_linux	eq	11.0
debian_linux	eq	12.0
firefox	lt	121.0
firefox_esr	lt	115.6
thunderbird	lt	115.6

References

bugzilla.mozilla.org/show_bug.cgi?id=1854669

lists.debian.org/debian-lts-announce/2023/12/msg00020.html

lists.debian.org/debian-lts-announce/2023/12/msg00021.html

security.gentoo.org/glsa/202401-10

www.debian.org/security/2023/dsa-5581

www.debian.org/security/2023/dsa-5582

www.mozilla.org/security/advisories/mfsa2023-54/

www.mozilla.org/security/advisories/mfsa2023-55/

www.mozilla.org/security/advisories/mfsa2023-56/