Published: 28/10/2010 Updated: 19/09/2017

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 950

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Mozilla Firefox 3.5.x up to and including 3.5.14 and 3.6.x up to and including 3.6.11, Thunderbird 3.1.6 prior to 3.1.6 and 3.0.x prior to 3.0.10, and SeaMonkey 2.x prior to 2.0.10, when JavaScript is enabled, allows remote malicious users to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox 3.5.5
mozilla firefox 3.5.4
mozilla firefox 3.5.1
mozilla firefox 3.5
mozilla firefox 3.5.7
mozilla firefox 3.5.6
mozilla firefox 3.5.12
mozilla firefox 3.5.11
mozilla firefox 3.5.10
mozilla firefox 3.5.9
mozilla firefox 3.5.8
mozilla firefox 3.5.14
mozilla firefox 3.5.13
mozilla firefox 3.5.3
mozilla firefox 3.5.2
mozilla firefox 3.6.4
mozilla firefox 3.6.6
mozilla firefox 3.6.2
mozilla firefox 3.6.3
mozilla firefox 3.6.10
mozilla firefox 3.6.11
mozilla firefox 3.6.9
mozilla firefox 3.6
mozilla firefox 3.6.7
mozilla firefox 3.6.8
mozilla thunderbird 3.1.3
mozilla thunderbird 3.1.1
mozilla thunderbird 3.0.2
mozilla thunderbird 3.0.9
mozilla thunderbird 3.1.2
mozilla thunderbird 3.1.4
mozilla thunderbird 3.0.7
mozilla thunderbird 3.0.6
mozilla thunderbird 3.0.4
mozilla thunderbird 3.0.5
mozilla thunderbird 3.0.8
mozilla thunderbird 3.1.5
mozilla thunderbird 3.0.1
mozilla thunderbird 3.0.3
mozilla seamonkey 2.0.2
mozilla seamonkey 2.0.7
mozilla seamonkey 2.0
mozilla seamonkey 2.0.3
mozilla seamonkey 2.0.8
mozilla seamonkey 2.0.6
mozilla seamonkey 2.0.5
mozilla seamonkey 2.0.4
mozilla seamonkey 2.0.1
mozilla seamonkey 2.0.9

Synopsis Critical: xulrunner security update Type/Severity Security Advisory: Critical Topic Updated xulrunner packages that fix one security issue are now availablefor Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as having criticalsecurity impact A Common Vulnerabili ...

Synopsis Critical: seamonkey security update Type/Severity Security Advisory: Critical Topic Updated seamonkey packages that fix one security issue are now availablefor Red Hat Enterprise Linux 3 and 4The Red Hat Security Response Team has rated this update as having criticalsecurity impact A Common Vulne ...

Thunderbird could be made to run programs as your login if it opened a specially crafted email message or news item ...

Firefox could be made to run programs as your login if it opened a specially crafted web page ...

A Xulrunner application could be made to run programs as your login if it opened a specially crafted file ...

Mozilla Foundation Security Advisory 2010-73 Heap buffer overflow mixing documentwrite and DOM insertion Announced October 27, 2010 Reporter Morten Kråkvik Impact Critical Products Firefox, SeaMonkey, Thunderbird Fixe ...

For those who still do not know The proof of concept (that I haveextracted) for CVE-2010-3765 is the following: <html><body><script> function G(str){ var cobj=documentcreateElement(str); documentbodyappendChild(cobj); cobjscrollWidth; } function crashme() { documentwrite("fooFOO"); G("a"); documentw ...

<!-- WARNING! This is exploit code from the wild The original first 2 unicode chars at 'id=sun8' were ub8acu1029 Use, as always, at your own risk <body> <div style="visibility:hidden;width:0px;height:0px"> <div id=sun8>uccccuccccu0d00u0d0du0d00u102du1000u0d00u102du1000u102du1000u2853u1000u0011u0000u116cu1000u0300u7ffeub45 ...

Source: bugzillamozillaorg/show_bugcgi?id=607222 <html><body> <script> function getatts(str){ var cobj=documentcreateElement(str); cobjid="testcase"; documentbodyappendChild(cobj); var obj=documentgetElementById("testcase"); var atts = new Array(); for(p in obj){ if(typeof(obj[p ...

Hi there, For those who still do not know The proof of concept (that I have extracted) for CVE-2010-3765 is the following: <html><body> <script> function G(str){ var cobj=documentcreateElement(str); documentbodyappendChild(cobj); cobjscrollWidth; } function crashme() { documentwrite("fooFOO"); ...

## # $Id: mozilla_interleaved_writerb 11796 2011-02-22 20:49:44Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/co ...

Firefox Tricked – Current 0day

Securelist • Kurt Baumgartner • 27 Oct 2010

Firefox (FF) users should be aware of a use-after-free vulnerability affecting Firefox versions 3.6.11 and earlier. The security team at Firefox has been working on getting a patch out since at least early Tuesday morning, delivering a v3.6.12 release candidate available for brave nightly build developers and testers last night. A zero day exploit attacking this vulnerability was used at the compromised Nobel Peace Prize website to drop a trojan on unsuspecting visitors’ systems, although the ...

CVE-2010-3765

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Recent Articles

References

Vulmon Search

About

Products

Connect