JavaScript garbage collection crash with Java applet

JavaScript garbage collection crash with Java applet

Announced

November 3, 2015

Reporter

Vytautas Staraitis

Impact

High

Products

Firefox, Firefox ESR

Fixed in

• Firefox 42
• Firefox ESR 38.4

Description

Mozilla community member Vytautas Staraitis reported an issue with the interaction of Java applets and JavaScript. The Java plugin can deallocate a JavaScript wrapper when it is still in use, which leads to a JavaScript garbage collection crash. This crash is potentially exploitable.

This issue only affects systems where Java is installed and enabled as a browser plugin. Other systems are unaffected.

References

• crashes in GC with Java applet (CVE-2015-7196)