Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2013-07

Crash due to handling of SSL on threads

Announced
January 8, 2013
Reporter
Jerry Baker
Impact
High
Products
Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR
Fixed in
  • Firefox 18
  • Firefox ESR 17.0.2
  • SeaMonkey 2.15
  • Thunderbird 17.0.2
  • Thunderbird ESR 17.0.2

Description

Mozilla community member Jerry Baker reported a crashing issue found through Thunderbird when downloading messages over a Secure Sockets Layer (SSL) connection. This was caused by a bug in the networking code assuming that secure connections were entirely handled on the socket transport thread when they can occur on a variety of threads. The resulting crash was potentially exploitable.

While the initial issue was found through Thunderbird, the affected networking library is common to Mozilla code.

References