The host is installed with Mozilla Firefox before 45.0, Firefox ESR 38.x before 38.7 or Thunderbird 38.x before 38.7 and is prone to a denial of service vulnerability. A flaw is present in the nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox, which fails to handle a crafted NPAPI plugin. Successful exploitation allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption).