CVE-2023-5170 — Missing Release of Memory after Effective Lifetime in Mozilla Firefox
Severity
7.4HIGHNVD
OSV6.5
EPSS
0.2%
top 53.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 27
Latest updateOct 11
Description
In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a memory leak of a privileged process. This memory leak could be used to effect a sandbox escape if the correct data was leaked. This vulnerability affects Firefox < 118.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:NExploitability: 2.8 | Impact: 4.0
Affected Packages3 packages
🔴Vulnerability Details
5OSV▶
CVE-2023-5170: In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a memory leak of a privileged proces↗2023-09-28
GHSA▶
GHSA-2gw5-9px7-vp56: In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a memory leak of a privileged proces↗2023-09-27
CVEList▶
CVE-2023-5170: In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a memory leak of a privileged proces↗2023-09-27