Lucene search

K
mozillaMozilla FoundationMFSA2011-06
HistoryMar 01, 2011 - 12:00 a.m.

Use-after-free error using Web Workers — Mozilla

2011-03-0100:00:00
Mozilla Foundation
www.mozilla.org
19

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.156 Low

EPSS

Percentile

96.0%

Daniel Kozlowski reported that a JavaScript Worker could be used to keep a reference to an object that could be freed during garbage collection. Subsequent calls through this deleted reference could cause attacker-controlled memory to be executed on a victim’s computer.

Affected configurations

Vulners
Node
mozillafirefoxRange<3.5.17
OR
mozillafirefoxRange<3.6.14
OR
mozillaseamonkeyRange<2.0.12
CPENameOperatorVersion
firefoxlt3.5.17
firefoxlt3.6.14
seamonkeylt2.0.12

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.156 Low

EPSS

Percentile

96.0%