CVE-2023-6856

HIGH 8.8CVE-2023-6856 · Published 19/12/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
firefox mozilla	`< 121.0`	`121.0`
firefox esr mozilla	`< 115.6`	`115.6`
thunderbird mozilla	`< 115.6`	`115.6`

Description

The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.

References

bugzilla.mozilla.org/show_bug.cgi · Issue Tracking
lists.debian.org/debian-lts-announce/2023/12/msg00020.html · Mailing List
lists.debian.org/debian-lts-announce/2023/12/msg00021.html · Mailing List
security.gentoo.org/glsa/202401-10 · Third Party Advisory
debian.org/security/2023/dsa-5581 · Third Party Advisory
debian.org/security/2023/dsa-5582 · Third Party Advisory
mozilla.org/security/advisories/mfsa2023-54 · Vendor Advisory
mozilla.org/security/advisories/mfsa2023-55 · Vendor Advisory
mozilla.org/security/advisories/mfsa2023-56 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free