CVE-2023-4582

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. *This bug only affects Firefox on macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Sep 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-458206.5Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has web CVE-2023-458216.3Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. Duri CVE-2023-458225.3Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. Duri CVE-2023-458237.5Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. Duri CVE-2023-458244.3OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinned pages of other users by pag CVE-2023-458255.5ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object CVE-2023-458266.5Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not paramete CVE-2023-458279.8Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object p CVE-2023-458285.4Missing Authorization vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Exploiting Incorrectl CVE-2023-458295.4Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in HappyBox Newsletter & Bulk Email Sender – Email Newsletter Plugin fo CVE-2023-45837.5When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to ha CVE-2023-458309.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Onli