« Volver al listado

CVE-2023-6856

Estado: ModificadaAlta (8.8)—

The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Debian — Debian LinuxMozilla — FirefoxMozilla — Firefox ESRMozilla — Thunderbird

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-6856",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "Mozilla",
          "product": "Firefox ESR",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "115.6",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Mozilla",
          "product": "Thunderbird",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "115.6",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Mozilla",
          "product": "Firefox",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "121",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-12-19T14:15:07.313",
  "references": [
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1843782",
      "tags": [
        "Issue Tracking",
        "Permissions Required"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/202401-10",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.debian.org/security/2023/dsa-5581",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.debian.org/security/2023/dsa-5582",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1843782",
      "tags": [
        "Issue Tracking",
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202401-10",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2023/dsa-5581",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2023/dsa-5582",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver.  This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121."
    },
    {
      "lang": "es",
      "value": "El método WebGL `DrawElementsInstanced` era susceptible a un desbordamiento de búfer cuando se usaba en sistemas con el controlador Mesa VM. Este problema podría permitir a un atacante realizar la ejecución remota de código y escapar de la zona de pruebas. Esta vulnerabilidad afecta a Firefox ESR &lt;115.6, Thunderbird &lt;115.6 y Firefox &lt;121."
    }
  ],
  "lastModified": "2026-06-17T06:51:33.267",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3D81D72-5965-4DB7-BFA7-9A32A9108919",
              "versionEndExcluding": "121.0"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46B36C5E-77B7-4FBF-8B7A-6F794C8B8B2B",
              "versionEndExcluding": "115.6"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1856451B-B03F-4BF2-AEFE-BF66D82D9E78",
              "versionEndExcluding": "115.6"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}