Race condition in the NPObjWrapper_NewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to execute arbitrary code via a page transition during Java applet loading, related to a use-after-free vulnerability for memory associated with a destroyed Java object.

Threat-Mapped Scoring

Score: 1.8

Priority: P4 - Informational (Low)

• S9 – Sabotage of System/App

EPSS

Score: 0.02184
Percentile: 0.83666

CVSS Scoring

Mapped CWE(s)

• CWE-362 : Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
• CWE-416 : Use After Free

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

Affected Products

• cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:4.8:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_eus:5.3:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*

← Back to Home