Crash when using debugger with SavedStacks in JavaScript

Crash when using debugger with SavedStacks in JavaScript

Announced

September 22, 2015

Reporter

Spandan Veggalam

Impact

Moderate

Products

Firefox, Firefox OS, SeaMonkey

Fixed in

• Firefox 41
• Firefox OS 2.5
• SeaMonkey 2.38

Description

Security researcher Spandan Veggalam reported a crash while using the debugger API with SavedStacks in JavaScript. This crash can only occurs when the debugger is in use but may be potentially exploitable.

References

• Crash due to Assertion failure: getSlotRef(EVAL).isUndefined() (CVE-2015-4507)