Fluid Attacks Database

Description

Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service (incorrect garbage collection and application crash) or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript wrapper.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel7	firefox	<0:38.4.0-1.el7_1	0:38.4.0-1.el7_1
rpm rhel5	firefox	<0:38.4.0-1.el5_11	0:38.4.0-1.el5_11
rpm rhel6	firefox	<0:38.4.0-1.el6_7	0:38.4.0-1.el6_7

Aliases

1. CVE-2015-71962. NVD-2015-71963. OSV-2015-7196

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.