Mozilla · Multiple Products
CVE-2010-3765
Mozilla Multiple Products Remote Code Execution Vulnerability
O que é
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
CISA: Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.
O que fazer
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 27 de outubro de 2025
- Adicionada à lista da CISA
- 6 de outubro de 2025
- Publicada
- 27 de outubro de 2010
- Gravidade
- Crítica 9,8 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 83% entre os 0,3% mais altos de todas as vulnerabilidades conhecidas
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (20)
- https://rhn.redhat.com/errata/RHSA-2010-0812.html
- http://www.redhat.com/support/errata/RHSA-2010-0896.html
- http://www.redhat.com/support/errata/RHSA-2010-0808.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050233.html
- http://www.ubuntu.com/usn/USN-1011-3
- http://www.securityfocus.com/bid/44425
- https://bugzilla.mozilla.org/show_bug.cgi?id=607222#c53
- http://www.vupen.com/english/advisories/2010/2837
- https://bugzilla.redhat.com/show_bug.cgi?id=646997
- http://support.avaya.com/css/P8/documents/100114335
- http://secunia.com/advisories/41965
- http://secunia.com/advisories/41975
- http://www.exploit-db.com/exploits/15341
- http://www.securitytracker.com/id?1024651
- http://secunia.com/advisories/41761
- https://bugzilla.mozilla.org/show_bug.cgi?id=607222
- http://norman.com/about_norman/press_center/news_archive/2010/129223/en?utm_source=twitterfeed&utm_medium=twi…
- http://secunia.com/advisories/41969
- http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
- http://www.norman.com/about_norman/press_center/news_archive/2010/129223/
Mais falhas exploradas de Mozilla
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 15 de out. de 2024 | Use-After-Free | Firefox | Crítica 9,8 | 23% |
| 22 de jun. de 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | Alto 7,5 | 87% |
| 25 de mai. de 2022 | Security Feature Bypass | Firefox | Alto 8,8 | 69% |
| 23 de mai. de 2022 | Type Confusion | Firefox and Thunderbird | Alto 8,8 | 38% |
| 23 de mai. de 2022 | Sandbox Escape | Firefox and Thunderbird | Crítica 10,0 | 56% |
| 28 de mar. de 2022 | Denial-of-Service | Firefox and Thunderbird | Alto 8,8 | 69% |
| 7 de mar. de 2022 | Use-After-Free | Firefox | Alto 8,8 | 14% |
| 7 de mar. de 2022 | Use-After-Free | Firefox | Crítica 9,6 | 2,4% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.