Crash due to handling of SSL on threads
- January 8, 2013
- Jerry Baker
- Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR
- Fixed in
- Firefox 18
- Firefox ESR 17.0.2
- SeaMonkey 2.15
- Thunderbird 17.0.2
- Thunderbird ESR 17.0.2
Mozilla community member Jerry Baker reported a crashing issue found through Thunderbird when downloading messages over a Secure Sockets Layer (SSL) connection. This was caused by a bug in the networking code assuming that secure connections were entirely handled on the socket transport thread when they can occur on a variety of threads. The resulting crash was potentially exploitable.
While the initial issue was found through Thunderbird, the affected networking library is common to Mozilla code.