Out-of-bounds write in Mozilla Firefox ESR
Priority MEDIUM 57CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 18 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.
Summary
The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
Why it matters now
EPSS 0.2063 97th percentileScored 2026-11-07
Fix Partial Firefox ESR (Mozilla): 115.6Thunderbird (Mozilla): 115.6+1 more productRed Hat: 18 advisoriesRed Hat: 18 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mozilla | Firefox ESR | before 115.6 | 115.6 | Patch available | CNA |
| Mozilla | Thunderbird | before 115.6 | 115.6 | Patch available | CNA |
| Mozilla | Firefox | before 121 | 121 | Patch available | CNA |
- Firefox ESR VendorMozilla Affected before 115.6 Fixed in 115.6 Patch available CNA
- Thunderbird VendorMozilla Affected before 115.6 Fixed in 115.6 Patch available CNA
- Firefox VendorMozilla Affected before 121 Fixed in 121 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | before 121.0 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* | before 115.6 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* | before 115.6 | Vulnerable | Mozilla |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Debian |
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions before 121.0 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* Versions before 115.6 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions before 115.6 Vulnerable ·Mozilla
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
Remediation
- Fix · CNA Firefox ESR (Mozilla) Fixed in 115.6
- Fix · CNA Thunderbird (Mozilla) Fixed in 115.6
- Fix · CNA Firefox (Mozilla) Fixed in 121
Red Hat 18 advisories
- RHSA-2024:0027 Released 2024-01-02 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux Client (v. 7) thunderbird-115.6.0-1.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-115.6.0-1.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-115.6.0-1.el7_9
- RHSA-2024:0029 Released 2024-01-02 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) thunderbird-115.6.0-1.el9_2
- RHSA-2024:0023 Released 2024-01-02 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox-115.6.0-1.el8_2
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) firefox-115.6.0-1.el8_2
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) firefox-115.6.0-1.el8_2
Show 15 more Red Hat advisories
- RHSA-2024:0030 Released 2024-01-02 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) thunderbird-115.6.0-1.el8_2
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) thunderbird-115.6.0-1.el8_2
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) thunderbird-115.6.0-1.el8_2
- RHSA-2024:0028 Released 2024-01-02 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird-115.6.0-1.el8_4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) thunderbird-115.6.0-1.el8_4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) thunderbird-115.6.0-1.el8_4
- RHSA-2024:0026 Released 2024-01-02 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux Client (v. 7) firefox-115.6.0-1.el7_9
- Red Hat Enterprise Linux Client Optional (v. 7) firefox-115.6.0-1.el7_9
- Red Hat Enterprise Linux Server (v. 7) firefox-115.6.0-1.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) firefox-115.6.0-1.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) firefox-115.6.0-1.el7_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-115.6.0-1.el7_9
- RHSA-2024:0003 Released 2024-01-02 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream (v. 8) thunderbird-115.6.0-1.el8_9
- RHSA-2024:0024 Released 2024-01-02 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) firefox-115.6.0-1.el8_6
- RHSA-2024:0022 Released 2024-01-02 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) firefox-115.6.0-1.el9_0
- RHSA-2024:0021 Released 2024-01-02 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox-115.6.0-1.el8_4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) firefox-115.6.0-1.el8_4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) firefox-115.6.0-1.el8_4
- RHSA-2024:0025 Released 2024-01-02 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream (v. 9) firefox-115.6.0-1.el9_3, firefox-x11-115.6.0-1.el9_3
- RHSA-2024:0019 Released 2024-01-02 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) firefox-115.6.0-1.el9_2, firefox-x11-115.6.0-1.el9_2
- RHSA-2024:0011 Released 2024-01-02 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) firefox-115.6.0-1.el8_8
- RHSA-2024:0012 Released 2024-01-02 · Red Hat rating Importantfirefox security update
- Red Hat Enterprise Linux AppStream (v. 8) firefox-115.6.0-1.el8_9
- RHSA-2024:0005 Released 2024-01-02 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) thunderbird-115.6.0-1.el8_6
- RHSA-2024:0004 Released 2024-01-02 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) thunderbird-115.6.0-1.el8_8
- RHSA-2024:0002 Released 2024-01-02 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) thunderbird-115.6.0-1.el9_0
- RHSA-2024:0001 Released 2024-01-02 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream (v. 9) thunderbird-115.6.0-1.el9_3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Mozilla Firefox 121
18 records Highest priority Priority MEDIUM 8 MEDIUM, 10 LOW
Other records, highest priority first
- TI-2023-06263 Out-of-bounds write in Mozilla Firefox ESRPriority MEDIUM 43
- TI-2023-06271 Improper handling of exceptional conditions in Mozilla FirefoxPriority MEDIUM 41
- TI-2023-06266 Out-of-bounds write in Mozilla Firefox ESRPriority MEDIUM 41
- Release ·
Mozilla Firefox ESR 115.6
11 records Highest priority Priority MEDIUM 7 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2023-06263 Out-of-bounds write in Mozilla Firefox ESRPriority MEDIUM 43
- TI-2023-06267 Use after free in Mozilla Firefox ESRPriority MEDIUM 42
- TI-2023-06266 Out-of-bounds write in Mozilla Firefox ESRPriority MEDIUM 41
Show 1 more group
- Release ·
Mozilla Thunderbird 115.6
11 records Highest priority Priority MEDIUM 7 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2023-06263 Out-of-bounds write in Mozilla Firefox ESRPriority MEDIUM 43
- TI-2023-06267 Use after free in Mozilla Firefox ESRPriority MEDIUM 42
- TI-2023-06266 Out-of-bounds write in Mozilla Firefox ESRPriority MEDIUM 41
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0003, RHSA-2024:0012 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:0001, RHSA-2024:0025 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2024:0023, RHSA-2024:0030 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2024:0021, RHSA-2024:0028 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2024:0023, RHSA-2024:0030 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2024:0021, RHSA-2024:0028 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2024:0005, RHSA-2024:0024 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:0004, RHSA-2024:0011 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2024:0002, RHSA-2024:0022 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:0019, RHSA-2024:0029 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2024:0023, RHSA-2024:0030 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2024:0021, RHSA-2024:0028 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2024:0026, RHSA-2024:0027 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2024:0026 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2024:0026 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2024:0026, RHSA-2024:0027 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2024:0026, RHSA-2024:0027 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2024:0026 |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6856
- 2026-10-03 Alias added: GHSA-9846-hqmr-2486
References
Advisory 8
- https://www.mozilla.org/security/advisories/mfsa2023-54/
- https://www.mozilla.org/security/advisories/mfsa2023-55/
- https://www.mozilla.org/security/advisories/mfsa2023-56/
- https://www.debian.org/security/2023/dsa-5581
- https://www.debian.org/security/2023/dsa-5582
- https://lists.debian.org/debian-lts-announce/2023/12/msg00020.html
- https://lists.debian.org/debian-lts-announce/2023/12/msg00021.html
- https://security.gentoo.org/glsa/202401-10
More Mozilla Firefox vulnerabilities
- TI-2024-08981 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.8
- TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
- TI-2019-08769 Improper input validation in Mozilla Firefox ESR KEVCVSS 3.1CRITICAL 10.0
- TI-2010-03577 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
- TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2023-6856 · CVE Program
- CVE-2023-6856 · NVD
- FIRST EPSS
- GHSA-9846-hqmr-2486 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-6856 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences