Mozilla · Multiple Products
CVE-2010-3765
Mozilla Multiple Products Remote Code Execution Vulnerability
What it is
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
CISA: Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 27, 2025
- Added to the CISA list
- October 6, 2025
- Published
- October 27, 2010
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 83% in the top 0.3% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (20)
- https://rhn.redhat.com/errata/RHSA-2010-0812.html
- http://www.redhat.com/support/errata/RHSA-2010-0896.html
- http://www.redhat.com/support/errata/RHSA-2010-0808.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050233.html
- http://www.ubuntu.com/usn/USN-1011-3
- http://www.securityfocus.com/bid/44425
- https://bugzilla.mozilla.org/show_bug.cgi?id=607222#c53
- http://www.vupen.com/english/advisories/2010/2837
- https://bugzilla.redhat.com/show_bug.cgi?id=646997
- http://support.avaya.com/css/P8/documents/100114335
- http://secunia.com/advisories/41965
- http://secunia.com/advisories/41975
- http://www.exploit-db.com/exploits/15341
- http://www.securitytracker.com/id?1024651
- http://secunia.com/advisories/41761
- https://bugzilla.mozilla.org/show_bug.cgi?id=607222
- http://norman.com/about_norman/press_center/news_archive/2010/129223/en?utm_source=twitterfeed&utm_medium=twi…
- http://secunia.com/advisories/41969
- http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
- http://www.norman.com/about_norman/press_center/news_archive/2010/129223/
More exploited flaws from Mozilla
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 15, 2024 | Use-After-Free | Firefox | Critical 9.8 | 23% |
| Jun 22, 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | High 7.5 | 87% |
| May 25, 2022 | Security Feature Bypass | Firefox | High 8.8 | 69% |
| May 23, 2022 | Type Confusion | Firefox and Thunderbird | High 8.8 | 38% |
| May 23, 2022 | Sandbox Escape | Firefox and Thunderbird | Critical 10.0 | 56% |
| Mar 28, 2022 | Denial-of-Service | Firefox and Thunderbird | High 8.8 | 69% |
| Mar 7, 2022 | Use-After-Free | Firefox | High 8.8 | 14% |
| Mar 7, 2022 | Use-After-Free | Firefox | Critical 9.6 | 2.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.