NetSight
IP …
critical10.0

CVE-2015-2731

Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.…

Impact

Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy.

Affected products

VendorProductAffected versions
MozillaFirefox
through 38.1.0
Versions 31.0, 31.1.0, 31.1.1, 31.3.0, 31.5.1
MozillaThunderbird
through 38.0.1
OracleSolaris
Version 11.3
MozillaFirefox Esr
Versions 31.1, 31.2, 31.3, 31.4, 31.5, 31.6.0

References