Log in Start free

Vulnerability · Published Sep 11, 2023 · Assigned by mozilla

CVE-2023-4582Buffer Overflow in WebGL glGetProgramiv

High 8.8

In plain English

A high-severity buffer overflow in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 40.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. *This bug only affects Firefox on macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20firefox-esr115.2.0-r0ALPINE-CVE-2023-4582
Alpine:v3.21firefox-esr115.2.0-r0ALPINE-CVE-2023-4582
Alpine:v3.22firefox-esr115.2.0-r0ALPINE-CVE-2023-4582
Alpine:v3.23firefox-esr115.2.0-r0ALPINE-CVE-2023-4582

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 117
Mozilla Firefox ESR unspecified – before 115.2
Mozilla Thunderbird unspecified – before 115.2

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References