Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team reported an out of bounds write in the Netscape Portable Runtime (NSPR) leading to a potentially exploitable crash or code execution. This issue is fixed in NSPR version 4.10.6.

This NSPR flaw was not exposed to web content in any shipped version of Firefox.

External Reference:

http://www.mozilla.org/security/announce/2014/mfsa2014-55.html

Acknowledgements:

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Abhishek Arya as the original reporter.