Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a shared worker.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefox | Dec 1, 2016 | Jul 5, 2015 |
| Freebsd | — | Upgrade linux-seamonkeyUpgrade linux-firefoxUpgrade seamonkeyUpgrade libxulUpgrade thunderbirdUpgrade firefox-esrUpgrade linux-thunderbirdUpgrade firefox | Dec 10, 2025 | Jul 16, 2015 |
| Gentoo Linux | — | Upgrade www-client/firefox-bin.Upgrade www-client/firefox.Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin. | Oct 30, 2017 | Jul 5, 2015 |
| Mfsa2015 65 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 39.0Upgrade to Mozilla Firefox ESR version 31.8Upgrade to Mozilla Firefox ESR version 38.1 | Jul 8, 2015 | Jul 5, 2015 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.35.0 | Oct 22, 2015 | Jul 5, 2015 |
| Oracle Solaris | — | Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade entire to version 0.5.11-0.175.3.0.0.30.0 on Solaris 11.3Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Jul 5, 2015 |
| Oracle_linux | — | Upgrade firefox | Oct 16, 2024 | Jul 6, 2015 |
| Suse | — | Upgrade mozilla-nss-sysinitUpgrade libfreebl3-hmac-32bitUpgrade libsoftokn3-x86Upgrade mozilla-nss-certs-debuginfo-x86Upgrade MozillaThunderbirdUpgrade MozillaFirefox-translations-commonUpgrade firefox-libgcc_s1Upgrade mozilla-nss-sysinit-debuginfo-32bitUpgrade mozilla-nspr-debuginfo-x86Upgrade mozilla-nss-debuginfo-32bitUpgrade mozillafirefox-buildsymbolsUpgrade MozillaThunderbird-translations-commonUpgrade libsoftokn3-debuginfo-32bitUpgrade MozillaThunderbird-debugsourceUpgrade firefox-libstdc++6Upgrade firefox-gcc47Upgrade mozilla-nspr-x86Upgrade MozillaFirefox-translationsUpgrade libfreebl3-hmacUpgrade mozilla-nssUpgrade mozilla-nss-sysinit-debuginfoUpgrade MozillaThunderbird-develUpgrade libsoftokn3-debuginfoUpgrade libsoftokn3-hmac-32bitUpgrade mozilla-nss-certs-debuginfo-32bitUpgrade MozillaFirefox-debugsourceUpgrade mozilla-nspr-debuginfoUpgrade libsoftokn3-32bitUpgrade MozillaFirefox-develUpgrade mozilla-nspr-debugsourceUpgrade mozillafirefox-branding-upstreamUpgrade libfreebl3-debuginfo-32bitUpgrade mozilla-nspr-develUpgrade MozillaFirefox-debuginfoUpgrade mozilla-nss-certsUpgrade mozilla-nss-sysinit-32bitUpgrade libsoftokn3-debuginfo-x86Upgrade mozilla-nss-sysinit-debuginfo-x86Upgrade libfreebl3-debuginfo-x86Upgrade mozilla-nspr-debuginfo-32bitUpgrade libfreebl3-x86Upgrade MozillaThunderbird-buildsymbolsUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nss-tools-debuginfoUpgrade mozilla-nss-toolsUpgrade MozillaThunderbird-debuginfoUpgrade mozilla-nss-certs-debuginfoUpgrade libfreebl3Upgrade libfreebl3-debuginfoUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-debugsourceUpgrade libsoftokn3-hmacUpgrade MozillaFirefoxUpgrade mozilla-nss-x86Upgrade mozilla-nsprUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nss-32bitUpgrade mozilla-nss-debuginfoUpgrade libfreebl3-32bitUpgrade libsoftokn3Upgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-develUpgrade mozilla-nss-certs-x86Upgrade mozilla-nss-sysinit-x86Upgrade mozilla-nss-debuginfo-x86 | May 18, 2016 | Jul 5, 2015 |
| Ubuntu | — | Upgrade firefox | Nov 8, 2024 | Jul 6, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub