CVE-2010-3765
Critical · 9.8 CISA KEVCVSS
9.8
EPSS
83.2%
Published
Oct 28, 2010
CISA due date
Oct 27, 2025
The record
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:5.0 | xulrunner | 0 | 1.9.0.19-6 |
| Red Hat:enterprise_linux:3::as | seamonkey | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-chat | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-debuginfo | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-dom-inspector | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-js-debugger | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-mail | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nspr | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nspr-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nss | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nss-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-chat | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-debuginfo | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-dom-inspector | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-js-debugger | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-mail | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nspr | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nspr-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nss | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nss-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-chat | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-debuginfo | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-dom-inspector | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-js-debugger | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-mail | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nspr | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nspr-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nss | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nss-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-chat | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-debuginfo | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-dom-inspector | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-js-debugger | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-mail | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nspr | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nspr-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nss | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nss-devel | 0 | 0:1.0.9-0.62.el3 |
| Red Hat:enterprise_linux:4::as | firefox | 0 | 0:3.6.11-4.el4_8 |
| Red Hat:enterprise_linux:4::as | firefox-debuginfo | 0 | 0:3.6.11-4.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-chat | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-debuginfo | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-devel | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-dom-inspector | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-js-debugger | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::as | seamonkey-mail | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::as | thunderbird | 0 | 0:1.5.0.12-33.el4 |
| Red Hat:enterprise_linux:4::as | thunderbird-debuginfo | 0 | 0:1.5.0.12-33.el4 |
| Red Hat:enterprise_linux:4::desktop | firefox | 0 | 0:3.6.11-4.el4_8 |
| Red Hat:enterprise_linux:4::desktop | firefox-debuginfo | 0 | 0:3.6.11-4.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-chat | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-debuginfo | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-devel | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-dom-inspector | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-js-debugger | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-mail | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::desktop | thunderbird | 0 | 0:1.5.0.12-33.el4 |
| Red Hat:enterprise_linux:4::desktop | thunderbird-debuginfo | 0 | 0:1.5.0.12-33.el4 |
| Red Hat:enterprise_linux:4::es | firefox | 0 | 0:3.6.11-4.el4_8 |
| Red Hat:enterprise_linux:4::es | firefox-debuginfo | 0 | 0:3.6.11-4.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-chat | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-debuginfo | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-devel | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-dom-inspector | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-js-debugger | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::es | seamonkey-mail | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::es | thunderbird | 0 | 0:1.5.0.12-33.el4 |
| Red Hat:enterprise_linux:4::es | thunderbird-debuginfo | 0 | 0:1.5.0.12-33.el4 |
| Red Hat:enterprise_linux:4::ws | firefox | 0 | 0:3.6.11-4.el4_8 |
| Red Hat:enterprise_linux:4::ws | firefox-debuginfo | 0 | 0:3.6.11-4.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-chat | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-debuginfo | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-devel | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-dom-inspector | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-js-debugger | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::ws | seamonkey-mail | 0 | 0:1.0.9-65.el4_8 |
| Red Hat:enterprise_linux:4::ws | thunderbird | 0 | 0:1.5.0.12-33.el4 |
| Red Hat:enterprise_linux:4::ws | thunderbird-debuginfo | 0 | 0:1.5.0.12-33.el4 |
| Red Hat:enterprise_linux:5::client | thunderbird | 0 | 0:2.0.0.24-10.el5_5 |
| Red Hat:enterprise_linux:5::client | thunderbird-debuginfo | 0 | 0:2.0.0.24-10.el5_5 |
| Red Hat:enterprise_linux:5::client | xulrunner | 0 | 0:1.9.2.11-4.el5_5 |
| Red Hat:enterprise_linux:5::client | xulrunner-debuginfo | 0 | 0:1.9.2.11-4.el5_5 |
| Red Hat:enterprise_linux:5::client | xulrunner-devel | 0 | 0:1.9.2.11-4.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | xulrunner | 0 | 0:1.9.2.11-4.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | xulrunner-debuginfo | 0 | 0:1.9.2.11-4.el5_5 |
| Red Hat:enterprise_linux:5::client_workstation | xulrunner-devel | 0 | 0:1.9.2.11-4.el5_5 |
| Red Hat:enterprise_linux:5::server | xulrunner | 0 | 0:1.9.2.11-4.el5_5 |
| Red Hat:enterprise_linux:5::server | xulrunner-debuginfo | 0 | 0:1.9.2.11-4.el5_5 |
| Red Hat:enterprise_linux:5::server | xulrunner-devel | 0 | 0:1.9.2.11-4.el5_5 |
| Red Hat:enterprise_linux:6::client | firefox | 0 | 0:3.6.12-1.el6_0 |
| Red Hat:enterprise_linux:6::client | firefox-debuginfo | 0 | 0:3.6.12-1.el6_0 |
| Red Hat:enterprise_linux:6::client | thunderbird | 0 | 0:3.1.6-1.el6_0 |
| Red Hat:enterprise_linux:6::client | thunderbird-debuginfo | 0 | 0:3.1.6-1.el6_0 |
| Red Hat:enterprise_linux:6::client | xulrunner | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::client | xulrunner-debuginfo | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::client | xulrunner-devel | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::computenode | firefox | 0 | 0:3.6.12-1.el6_0 |
| Red Hat:enterprise_linux:6::computenode | firefox-debuginfo | 0 | 0:3.6.12-1.el6_0 |
| Red Hat:enterprise_linux:6::computenode | xulrunner | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::computenode | xulrunner-debuginfo | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::computenode | xulrunner-devel | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::server | firefox | 0 | 0:3.6.12-1.el6_0 |
| Red Hat:enterprise_linux:6::server | firefox-debuginfo | 0 | 0:3.6.12-1.el6_0 |
| Red Hat:enterprise_linux:6::server | thunderbird | 0 | 0:3.1.6-1.el6_0 |
| Red Hat:enterprise_linux:6::server | thunderbird-debuginfo | 0 | 0:3.1.6-1.el6_0 |
| Red Hat:enterprise_linux:6::server | xulrunner | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::server | xulrunner-debuginfo | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::server | xulrunner-devel | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::workstation | firefox | 0 | 0:3.6.12-1.el6_0 |
| Red Hat:enterprise_linux:6::workstation | firefox-debuginfo | 0 | 0:3.6.12-1.el6_0 |
| Red Hat:enterprise_linux:6::workstation | thunderbird | 0 | 0:3.1.6-1.el6_0 |
| Red Hat:enterprise_linux:6::workstation | thunderbird-debuginfo | 0 | 0:3.1.6-1.el6_0 |
| Red Hat:enterprise_linux:6::workstation | xulrunner | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::workstation | xulrunner-debuginfo | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:enterprise_linux:6::workstation | xulrunner-devel | 0 | 0:1.9.2.12-1.el6_0 |
| Red Hat:rhel_productivity:5 | thunderbird | 0 | 0:2.0.0.24-10.el5_5 |
| Red Hat:rhel_productivity:5 | thunderbird-debuginfo | 0 | 0:2.0.0.24-10.el5_5 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 50.1.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 45.5.1-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 128.5.1-1.1 |
Related vulnerabilities
- CVE-2011-2371 Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x… Also affects xulrunner
- CVE-2010-3179 Stack-based buffer overflow in the text-rendering functionality in Mozilla Firefox before… Also affects xulrunner
- CVE-2010-1205 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… Also affects xulrunner
- CVE-2010-1199 Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before… Also affects xulrunner
- CVE-2010-0167 The browser engine in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x… Also affects xulrunner
- CVE-2009-3382 layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x… Also affects xulrunner
- CVE-2009-3373 Heap-based buffer overflow in the GIF image parser in Mozilla Firefox before 3.0.15 and… Also affects xulrunner
- CVE-2009-2464 The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before… Also affects xulrunner