Description
Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | firefox | 41.0+build3-0ubuntu0.14.04.1 | USN-2743-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | firefox | 38.3.0-2.0.1.el7_1 | ELSA-2015-1834 |
Advisories 4
- USN-2743-1 firefox vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ELSA-2015-1834 Critical: firefox security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 22, 2015
References
- openSUSE-SU-2015:1681 vendor-advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-104.html
- USN-2743-4 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- USN-2743-3 vendor-advisory
- 76815 vdb-entry
- USN-2743-2 vendor-advisory
- 1033640 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1200004
- openSUSE-SU-2015:1658 vendor-advisory
- USN-2743-1 vendor-advisory