Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown.
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "firefox",
"binary_version": "38.0+build3-0ubuntu0.14.04.1"
},
{
"binary_name": "firefox-globalmenu",
"binary_version": "38.0+build3-0ubuntu0.14.04.1"
},
{
"binary_name": "firefox-mozsymbols",
"binary_version": "38.0+build3-0ubuntu0.14.04.1"
},
{
"binary_name": "firefox-testsuite",
"binary_version": "38.0+build3-0ubuntu0.14.04.1"
}
]
}