Mozilla Foundation Security Advisory 2013-07
Title: Crash due to handling of SSL on threads
Announced: January 8, 2013
Reporter: Jerry Baker
Products: Firefox, Thunderbird, SeaMonkey
Fixed in: Firefox 18.0
Firefox ESR 17.0.2
Thunderbird ESR 17.0.2
Mozilla community member Jerry Baker reported a crashing issue found through Thunderbird when downloading messages over a Secure Sockets Layer (SSL) connection. This was caused by a bug in the networking code assuming that secure connections were entirely handled on the socket transport thread when they can occur on a variety of threads. The resulting crash was potentially exploitable.
While the initial issue was found through Thunderbird, the affected networking library is common to Mozilla code.