Firefox DOM Core CVE-2013-1694 Wrapper Cache Defect Fix

Critical Vulnerability Information Vulnerability Overview CVE ID: CVE-2013-1694 Vulnerability Name: Use of PreserveWrapper in cases when we don't have a wrapper seems broken Vulnerability Type: Defect Affected Scope Product: Core Component: DOM: Core & HTML Platforms: x86, macOS Status and Tracking Status: RESOLVED FIXED Milestone: mozilla24 Key Tracking Information Firefox 20-24: Fixed Firefox 22+: Fixed Firefox b2g18: Fixed Vulnerability Description 1. XHR starts. 2. Its wrapper, if any, is collected. 3. A C++/readyStateChange listener calls GetResponse, and the response type is JSON or arraybuffer. This causes nsXMLHttpRequest::RootJSResultObjects to be called, which calls PreserveWrapper. 4. JS touches the XHR object, causing it to be wrapped, which calls nsWrapperCache::SetWrapper. In a debug build, this will trigger a fatal assertion. In an optimized build, this will clear the preserved-wrapper flag on the wrapper cache, which appears to be problematic. Mitigation Measures The solution involves preserving the flag during SetWrapper and removing the assertion in that method. Alternatively, it might be preferable to stop using PreserveWrapper to indicate "hold JS objects" in XHR. Review and Approval Multiple changes were reviewed and approved by key stakeholders. Patches were attached and approved for various branches. Fix Verification Testing was completed on m-c, etc., and the patch was successfully landed.

Goal Reached Thanks to every supporter — we hit 100%!

Firefox DOM Core CVE-2013-1694 Wrapper Cache Defect Fix