rewindex

RewindexCVEs

CVE-2010-3765: Mozilla Multiple Products Remote Code Execution Vulnerability

Critical · CVSS 9.8 (CVSS 3.1)KEV known exploitedEPSS 83.2%, 100th percentilePublished Updated Assigner: mitre

In CISA’s Known Exploited Vulnerabilities catalog: Mozilla Multiple Products Remote Code Execution Vulnerability.

Added , federal remediation due . Known ransomware use: Unknown.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Mozilla: Multiple Products

References

All CVEsMarkdownJSON