TypedArrayObject.cpp in Mozilla Firefox before 28.0 Firefox ESR 24.x before 24.4 Thunderbird before 24.4 and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site.