Integer Overflow in RecordedSourceSurfaceCreation
Published Sep 11, 2023
8.6
HIGHCVSS 3.1
EPSS 0.82%
Description
On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<117
- Version
-
- Version unspecifiedStatusaffectedConstraints<102.15
- Version unspecifiedStatusaffectedConstraints<115.2
- Version
-
- Version unspecifiedStatusaffectedConstraints<102.15
- Version unspecifiedStatusaffectedConstraints<115.2
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox | n/a |
| |||||||||
| Mozilla | Firefox ESR | n/a |
| |||||||||
| Mozilla | Thunderbird | n/a |
|
- < 117.0
- ≥ 115.0 · < 115.2
- < 102.15
- < 115.2
-
- Version 0StatusaffectedConstraints<117
- Version
-
- Version 0StatusaffectedConstraints<102.15
- Version 0StatusaffectedConstraints<115.2
- Version
-
- Version 0StatusaffectedConstraints<102.15
- Version 0StatusaffectedConstraints<115.2
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox | n/a |
| |||||||||
| Mozilla | Firefox Esr | n/a |
| |||||||||
| Mozilla | Thunderbird | n/a |
|
Red Hat Enterprise Linux 6
firefox
Not affected
Red Hat Enterprise Linux 6
thunderbird
Not affected
Red Hat Enterprise Linux 7
firefox
Not affected
Red Hat Enterprise Linux 7
thunderbird
Not affected
Red Hat Enterprise Linux 8
firefox
Not affected
Red Hat Enterprise Linux 8
thunderbird
Not affected
Red Hat Enterprise Linux 9
firefox
Not affected
Red Hat Enterprise Linux 9
thunderbird
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | firefox | Not affected | n/a |
| Red Hat Enterprise Linux 6 | thunderbird | Not affected | n/a |
| Red Hat Enterprise Linux 7 | firefox | Not affected | n/a |
| Red Hat Enterprise Linux 7 | thunderbird | Not affected | n/a |
| Red Hat Enterprise Linux 8 | firefox | Not affected | n/a |
| Red Hat Enterprise Linux 8 | thunderbird | Not affected | n/a |
| Red Hat Enterprise Linux 9 | firefox | Not affected | n/a |
| Red Hat Enterprise Linux 9 | thunderbird | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
References (11)
- https://access.redhat.com/security/cve/CVE-2023-4576 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1846694 Issue TrackingPermissions Required
- https://bugzilla.redhat.com/show_bug.cgi?id=2236074 Issue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2023-4576
- https://www.cve.org/CVERecord?id=CVE-2023-4576
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4576
- https://www.mozilla.org/security/advisories/mfsa2023-34/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-35/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-36/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-37/
- https://www.mozilla.org/security/advisories/mfsa2023-38/ Vendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-4576 | Vendor Advisory | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1846694 | Issue TrackingPermissions Required | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2236074 | Issue Tracking | |
| https://nvd.nist.gov/vuln/detail/CVE-2023-4576 | ||
| https://www.cve.org/CVERecord?id=CVE-2023-4576 | ||
| https://www.mozilla.org/en-US/security/advisories/mfsa2023-36/#CVE-2023-4576 | ||
| https://www.mozilla.org/security/advisories/mfsa2023-34/ | Vendor Advisory | |
| https://www.mozilla.org/security/advisories/mfsa2023-35/ | Vendor Advisory | |
| https://www.mozilla.org/security/advisories/mfsa2023-36/ | Vendor Advisory | |
| https://www.mozilla.org/security/advisories/mfsa2023-37/ | ||
| https://www.mozilla.org/security/advisories/mfsa2023-38/ | Vendor Advisory |
Change history (0)
No recorded changes yet.