CVE-2023-6856

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Firefox ESR	>= unspecified, < 115.6
Mozilla	Thunderbird	>= unspecified, < 115.6
Mozilla	Firefox	>= unspecified, < 121

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1843782Issue Tracking, Permissions Required
https://lists.debian.org/debian-lts-announce/2023/12/msg00020.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00021.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202401-10Third Party Advisory
https://www.debian.org/security/2023/dsa-5581Third Party Advisory
https://www.debian.org/security/2023/dsa-5582Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-54/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-55/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-56/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1843782Issue Tracking, Permissions Required
https://lists.debian.org/debian-lts-announce/2023/12/msg00020.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00021.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202401-10Third Party Advisory
https://www.debian.org/security/2023/dsa-5581Third Party Advisory
https://www.debian.org/security/2023/dsa-5582Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-54/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-55/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-56/Vendor Advisory

Timeline

Published: Dec 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-68575.3When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only aff CVE-2023-68588.8Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox E CVE-2023-68598.8A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderb CVE-2023-68606.5The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This CVE-2023-68618.8The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects CVE-2023-68628.8A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affe CVE-2023-68638.8The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destr CVE-2023-68648.8Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption CVE-2023-68656.5`EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local CVE-2023-68668.8TypedArrays can be fallible and lacked proper exception handling. This could lead to abuse in other APIs which expect TypedArrays to always CVE-2023-68676.1The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission pro CVE-2023-68684.3In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one