CVE-2023-6856
published 2023-12-19CVE-2023-6856: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an…
PriorityP262high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
20.47%
97.2th percentile
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | firefox | < firefox 121.0-1 (sid) | firefox 121.0-1 (sid) |
| debian | firefox-esr | < firefox 121.0-1 (sid) | firefox 121.0-1 (sid) |
| debian | thunderbird | < firefox 121.0-1 (sid) | firefox 121.0-1 (sid) |
| mozilla | firefox | < 121.0 | 121.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 121.0+build1-0ubuntu0.20.04.1 | 121.0+build1-0ubuntu0.20.04.1 |
| mozilla | firefox | >= 0 < 121.0.1+build1-0ubuntu0.20.04.1 | 121.0.1+build1-0ubuntu0.20.04.1 |
| mozilla | firefox | >= unspecified < 121 | 121 |
| mozilla | firefox_esr | < 115.6 | 115.6 |
| mozilla | firefox_esr | >= unspecified < 115.6 | 115.6 |
| mozilla | thunderbird | < 115.6 | 115.6 |
| mozilla | thunderbird | >= 0 < 1:115.6.0-1~deb11u1 | 1:115.6.0-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:115.6.0-1~deb12u1 | 1:115.6.0-1~deb12u1 |
| mozilla | thunderbird | >= 0 < 1:115.6.0-1 | 1:115.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:115.6.0-1 | 1:115.6.0-1 |
| mozilla | thunderbird | >= 0 < 1:115.6.0+build2-0ubuntu0.20.04.1 | 1:115.6.0+build2-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= 0 < 1:115.6.0+build2-0ubuntu0.22.04.1 | 1:115.6.0+build2-0ubuntu0.22.04.1 |
| mozilla | thunderbird | >= unspecified < 115.6 | 115.6 |
| msrc | azl3_mozjs_102.15.1-1_on_azure_linux_3.0 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Target the WebGL `DrawElementsInstanced` method specifically on systems using the Mesa VM driver — heap buffer overflow triggered via this WebGL call is the attack vector for CVE-2023-6856. ↗
- →Exploitation can result in remote code execution AND sandbox escape — monitor for renderer/content process spawning unexpected child processes or accessing resources outside the sandbox boundary in Firefox/Thunderbird on Mesa VM driver systems. ↗
- →Scope of vulnerable products: Firefox < 121, Firefox ESR < 115.6, Thunderbird < 115.6 — flag any of these unpatched versions running on Mesa VM driver environments as high-priority targets. ↗
- ·The vulnerability is only exploitable on systems using the Mesa VM driver — deployments using other GPU/graphics drivers are not affected by this specific heap overflow path. ↗
- ·Debian scopes this as 'local' impact, which may affect detection priority in purely remote-access threat models; however, the NVD and Mozilla advisories describe remote code execution as a possible outcome. ↗
- ·Microsoft notes Azure Linux (Mariner) as a potentially affected product due to inclusion of the open-source library; customer action is required for those environments. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox regressions
vendor_ubuntu·2024-01-11·CVSS 4.3
[MEDIUM] Firefox regressions
Title: Firefox regressions
Summary: USN-6562-1 caused some minor regressions in Firefox.
USN-6562-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code.(CVE-2023-6865,
CVE-2023-6857, CVE-2023-6858, CVE-2023-6859, CVE-2023-6866, CVE-2023-6867,
CVE-2023-6861, CVE-2023-6869, CVE-2023-6871, CVE-2023-6872, CVE-2023-6863,
CVE-2023-6864, CVE-2023-6873)
DoHyun Lee discovered that Firefox did not properly manage
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2024-01-02·CVSS 4.3
CVE-2023-6857 [MEDIUM] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code.(CVE-2023-6865,
CVE-2023-6857, CVE-2023-6858, CVE-2023-6859, CVE-2023-6866, CVE-2023-6867,
CVE-2023-6861, CVE-2023-6869, CVE-2023-6871, CVE-2023-6872, CVE-2023-6863,
CVE-2023-6864, CVE-2023-6873)
DoHyun Lee discovered that Firefox did not properly manage memory when used
on systems with the Mesa VM driver. An attacker could potentially exploit
this issue to execute arbitrary code. (CVE-2023-6856)
George Pantela and Hubert Kario discovered tha
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2024-01-02·CVSS 4.3
CVE-2023-6859 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code.(CVE-2023-6857, CVE-2023-6858,
CVE-2023-6859, CVE-2023-6861, CVE-2023-6862, CVE-2023-6863, CVE-2023-6864)
Marcus Brinkmann discovered that Thunderbird did not properly parse a PGP/MIME
payload that contains digitally signed text. An attacker could potentially
exploit this issue to spoof an email message. (CVE-2023-50762)
Marcus Brinkmann discovered that Thunderbird did not p
Red Hat
Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM driver
vendor_redhat·2023-12-19·CVSS 8.8
CVE-2023-6856 [HIGH] CWE-122 Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM driver
Mozilla: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
The Mozilla Foundation Security Advisory describes this flaw as:
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Securit
Microsoft
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution an
vendor_msrc·2023-12-12·CVSS 8.8
CVE-2023-6856 [HIGH] CWE-787 The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution an
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to addi
Debian
CVE-2023-6856: firefox - The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overfl...
vendor_debian·2023·CVSS 8.8
CVE-2023-6856 [HIGH] CVE-2023-6856: firefox - The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overfl...
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
Scope: local
sid: resolved (fixed in 121.0-1)
Mozilla
Mozilla Foundation Security Advisory 2023-55: CVE-2023-6856
vendor_mozilla·CVSS 8.8
CVE-2023-6856 [HIGH] Mozilla Foundation Security Advisory 2023-55: CVE-2023-6856
Mozilla Foundation Security Advisory 2023-55
CVE: CVE-2023-6856
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 115.6
Mozilla
Mozilla Foundation Security Advisory 2023-56: CVE-2023-6856
vendor_mozilla·CVSS 8.8
CVE-2023-6856 [HIGH] Mozilla Foundation Security Advisory 2023-56: CVE-2023-6856
Mozilla Foundation Security Advisory 2023-56
CVE: CVE-2023-6856
Product: Firefox
Impact: high
Fixed in: Firefox 121
Mozilla
Mozilla Foundation Security Advisory 2023-54: CVE-2023-6856
vendor_mozilla·CVSS 8.8
CVE-2023-6856 [HIGH] Mozilla Foundation Security Advisory 2023-54: CVE-2023-6856
Mozilla Foundation Security Advisory 2023-54
CVE: CVE-2023-6856
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 115.6
OSV
firefox regressions
osv·2024-01-11·CVSS 4.3
CVE-2023-6865 [MEDIUM] firefox regressions
firefox regressions
USN-6562-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code.(CVE-2023-6865,
CVE-2023-6857, CVE-2023-6858, CVE-2023-6859, CVE-2023-6866, CVE-2023-6867,
CVE-2023-6861, CVE-2023-6869, CVE-2023-6871, CVE-2023-6872, CVE-2023-6863,
CVE-2023-6864, CVE-2023-6873)
DoHyun Lee discovered that Firefox did not properly manage memory when used
on systems with the Mesa VM driver. An attacker coul
OSV
thunderbird vulnerabilities
osv·2024-01-02·CVSS 4.3
CVE-2023-6857 [MEDIUM] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code.(CVE-2023-6857, CVE-2023-6858,
CVE-2023-6859, CVE-2023-6861, CVE-2023-6862, CVE-2023-6863, CVE-2023-6864)
Marcus Brinkmann discovered that Thunderbird did not properly parse a PGP/MIME
payload that contains digitally signed text. An attacker could potentially
exploit this issue to spoof an email message. (CVE-2023-50762)
Marcus Brinkmann discovered that Thunderbird did not properly compare the
signature creation date with the message date an
OSV
firefox vulnerabilities
osv·2024-01-02·CVSS 4.3
CVE-2023-6865 [MEDIUM] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code.(CVE-2023-6865,
CVE-2023-6857, CVE-2023-6858, CVE-2023-6859, CVE-2023-6866, CVE-2023-6867,
CVE-2023-6861, CVE-2023-6869, CVE-2023-6871, CVE-2023-6872, CVE-2023-6863,
CVE-2023-6864, CVE-2023-6873)
DoHyun Lee discovered that Firefox did not properly manage memory when used
on systems with the Mesa VM driver. An attacker could potentially exploit
this issue to execute arbitrary code. (CVE-2023-6856)
George Pantela and Hubert Kario discovered that Firefox using multiple NSS
NIST curves which were susceptible
GHSA
GHSA-9846-hqmr-2486: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver
ghsa_unreviewed·2023-12-19
CVE-2023-6856 [HIGH] CWE-787 GHSA-9846-hqmr-2486: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
OSV
CVE-2023-6856: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver
osv·2023-12-19·CVSS 8.8
CVE-2023-6856 [HIGH] CVE-2023-6856: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
No detection rules found.
No public exploits indexed.
Bugzilla
[#1, Incomplete patch and variant vulnerabilities of 1914707] Parent Process (Unsandboxed) Out-Of-Bounds Write in WebGL CreateSampler
bugzilla·2024-10-11·CVSS 8.8
[HIGH] [#1, Incomplete patch and variant vulnerabilities of 1914707] Parent Process (Unsandboxed) Out-Of-Bounds Write in WebGL CreateSampler
[#1, Incomplete patch and variant vulnerabilities of 1914707] Parent Process (Unsandboxed) Out-Of-Bounds Write in WebGL CreateSampler
Created attachment 9430474
0-Day_firefox-MozFramebuffer-OOB-Write.html
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Steps to reproduce:
## High-level overview of the vulnerability and the possible effect of using it
- A Out-Of-Bounds Write Vulnerability exists in the WebGL CreateSampler.
- An attacker must open a arbitrary generated HTML file to exploit this vulnerability.
- Exploiting this vulnerability can lead to a privileged process (GPU Process), enabling a sandbox escape.
- like : CVE-2023-6856 => Heap-Buffer-Overflow Sandbox Escape in Mozilla Firefox WebGL
## E
Bugzilla
Parent Process (Unsandboxed) Out-Of-Bounds Write on WebGL vertexAttribDivisor
bugzilla·2024-08-24·CVSS 8.8
[HIGH] Parent Process (Unsandboxed) Out-Of-Bounds Write on WebGL vertexAttribDivisor
Parent Process (Unsandboxed) Out-Of-Bounds Write on WebGL vertexAttribDivisor
Created attachment 9420656
poc.html
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Steps to reproduce:
## High-level overview of the vulnerability and the possible effect of using it
- A Out-Of-Bounds Write Vulnerability exists in the WebGL gleLLVMStoreDataToOutFloatInFloat.
- An attacker must open a arbitrary generated HTML file to exploit this vulnerability.
- Exploiting this vulnerability can lead to a privileged process (GPU Process), enabling a sandbox escape.
- like : CVE-2023-6856 => Heap-Buffer-Overflow Sandbox Escape in Mozilla Firefox WebGL
## Exact product that was found to be vulnerable including complete version
Checkpoint
25th December – Threat Intelligence Report
blogs_checkpoint·2023-12-25·CVSS 7.5
CVE-2023-4966 [HIGH] 25th December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 25th December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 25th December, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Australia’s largest non-profit healthcare provider, St. Vincent’s Health Australia, experienced a cyberattack resulting in data theft from its networks. Vincent’s operates public and private hospitals, as well as elderly care facilities across New South Wales, Victoria, and Queensland, employing over 20,000 staff.
Xfin
https://bugzilla.mozilla.org/show_bug.cgi?id=1843782https://lists.debian.org/debian-lts-announce/2023/12/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2023/12/msg00021.htmlhttps://security.gentoo.org/glsa/202401-10https://www.debian.org/security/2023/dsa-5581https://www.debian.org/security/2023/dsa-5582https://www.mozilla.org/security/advisories/mfsa2023-54/https://www.mozilla.org/security/advisories/mfsa2023-55/https://www.mozilla.org/security/advisories/mfsa2023-56/https://bugzilla.mozilla.org/show_bug.cgi?id=1843782https://lists.debian.org/debian-lts-announce/2023/12/msg00020.htmlhttps://lists.debian.org/debian-lts-announce/2023/12/msg00021.htmlhttps://security.gentoo.org/glsa/202401-10https://www.debian.org/security/2023/dsa-5581https://www.debian.org/security/2023/dsa-5582https://www.mozilla.org/security/advisories/mfsa2023-54/https://www.mozilla.org/security/advisories/mfsa2023-55/https://www.mozilla.org/security/advisories/mfsa2023-56/
2023-12-19
Published