CVE-2023-4576 — Integer Overflow or Wraparound in Mozilla Firefox
Severity
8.6HIGHNVD
EPSS
0.3%
top 44.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 11
Description
On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape.
*This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NExploitability: 3.9 | Impact: 4.0
Affected Packages6 packages
🔴Vulnerability Details
3OSV▶
CVE-2023-4576: On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive↗2023-09-11
GHSA▶
GHSA-qcr8-g46x-v65q: On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive↗2023-09-11
📋Vendor Advisories
7Debian▶
CVE-2023-4576: firefox - On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` w...↗2023