Log in Start free

Vulnerability · Published Sep 11, 2023 · Assigned by mozilla

CVE-2023-4576Integer Overflow in RecordedSourceSurfaceCreation

High 8.6

In plain English

A high-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.6High
Exploit odds (30 days)0.8%top 42.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20firefox-esr115.2.0-r0ALPINE-CVE-2023-4576
Alpine:v3.21firefox-esr115.2.0-r0ALPINE-CVE-2023-4576
Alpine:v3.22firefox-esr115.2.0-r0ALPINE-CVE-2023-4576
Alpine:v3.23firefox-esr115.2.0-r0ALPINE-CVE-2023-4576
Ubuntu:22.04:LTSfirefoxno fix listedUBUNTU-CVE-2023-4576
Ubuntu:22.04:LTSmozjs102no fix listedUBUNTU-CVE-2023-4576
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2023-4576
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2023-4576
Ubuntu:22.04:LTSthunderbirdno fix listedUBUNTU-CVE-2023-4576

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 117
Mozilla Firefox ESR unspecified – before 102.15
Mozilla Firefox ESR unspecified – before 115.2
Mozilla Thunderbird unspecified – before 102.15
Mozilla Thunderbird unspecified – before 115.2

References