Mozilla Foundation Security Advisory 2015-130
JavaScript garbage collection crash with Java applet
- Announced
- November 3, 2015
- Reporter
- Vytautas Staraitis
- Impact
- High
- Products
- Firefox, Firefox ESR
- Fixed in
-
- Firefox 42
- Firefox ESR 38.4
Description
Mozilla community member Vytautas Staraitis reported an issue with the interaction of Java applets and JavaScript. The Java plugin can deallocate a JavaScript wrapper when it is still in use, which leads to a JavaScript garbage collection crash. This crash is potentially exploitable.
This issue only affects systems where Java is installed and enabled as a browser plugin. Other systems are unaffected.