Mozilla

Mozilla Foundation Security Advisory 2015-130

JavaScript garbage collection crash with Java applet

Announced
November 3, 2015
Reporter
Vytautas Staraitis
Impact
High
Products
Firefox, Firefox ESR
Fixed in
  • Firefox 42
  • Firefox ESR 38.4

Description

Mozilla community member Vytautas Staraitis reported an issue with the interaction of Java applets and JavaScript. The Java plugin can deallocate a JavaScript wrapper when it is still in use, which leads to a JavaScript garbage collection crash. This crash is potentially exploitable.

This issue only affects systems where Java is installed and enabled as a browser plugin. Other systems are unaffected.

References