CVE-2010-3765criticalunder attackCWE-119

CVE-2010-3765

Published · Updated

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 83%
from disclosure to weapon1 day
Published on NVDOct 27
1st PoC+1d
metasploitOct 25
CISA KEV+5458d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
19 products (816 components)
Red Hat Enterprise Linux AS version 4 · Red Hat Enterprise Linux Desktop version 4 · Red Hat Enterprise Linux ES version 4 · Red Hat Enterprise Linux WS version 4 · Red Hat Desktop version 3 · and others 14
fix ↗
Action required by CISAfederal deadline: 2025-10-27

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Firefox, Thunderbird, and SeaMonkey allow remote attackers to execute arbitrary code through malformed JavaScript that corrupts memory by incorrectly managing frames created during DOM manipulation. This vulnerability was actively exploited by the Belmoo malware in October 2010.

Technical detail

A memory corruption vulnerability in the CSS frame constructor (nsCSSFrameConstructor::ContentAppended) allows remote code execution when JavaScript is enabled. The flaw occurs due to incorrect index tracking during appendChild operations and multiple frame creation, enabling attackers to corrupt heap memory and achieve arbitrary code execution. This vulnerability affects Firefox 3.5.x–3.5.14 and 3.6.x–3.6.11, Thunderbird 3.0.x–3.0.9 and 3.1.x before 3.1.6, and SeaMonkey 2.x before 2.0.10.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.