CVE-2010-3765 kev in the critical feed json
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x be…
published 2010-10-27 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-3744
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2025-10-06
- epss
- 83.2%
- EPSS 83.2% chance of exploitation in 30 days, percentile 99.6%
- public exploits
- 5
- Metasploit, Exploit-DB
Summary
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
Patch / fix
cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- thunderbird RHEL 6 3.1.6-1.el6_0
- firefox RHEL 6 3.6.12-1.el6_0
- xulrunner RHEL 6 1.9.2.12-1.el6_0
- thunderbird RHEL 4 1.5.0.12-33.el4
- thunderbird RHEL 5 PRODUCTIVITY, RHEL 5 2.0.0.24-10.el5_5
- seamonkey RHEL 3 1.0.9-0.62.el3
- seamonkey RHEL 4 1.0.9-65.el4_8
- seamonkey-nss RHEL 3 1.0.9-0.62.el3
red hat advisories RHSA-2010:0896RHSA-2010:0861RHSA-2010:0812RHSA-2010:0810RHSA-2010:0809RHSA-2010:0808
- firefox-esr openSUSE Tumbleweed 128.5.1-1.1
- MozillaFirefox openSUSE Tumbleweed 50.1.0-1.1
- MozillaThunderbird openSUSE Tumbleweed 45.5.1-1.1
opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:10071-1openSUSE-SU-2024:10230-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2010-3765 updated cvss 6.8
Firefox race condition flaw (MFSA 2010-73)
-
Red Hat Desktop version 3 seamonkey 1.0.9-0.62.el3, seamonkey-nss 1.0.9-0.62.el3, seamonkey-chat 1.0.9-0.62.el3, seamonkey-mail 1.0.9-0.62.el3, seamonkey-nspr 1.0.9-0.62.el3, seamonkey-js-debugger 1.0.9-0.62.el3, +1 morefixed: vendor fix RHSA-2010:0810
-
Red Hat Enterprise Linux (v. 5 server) xulrunner 1.9.2.11-4.el5_5fixed: vendor fix RHSA-2010:0809
-
Red Hat Enterprise Linux AS version 3 seamonkey 1.0.9-0.62.el3, seamonkey-nss 1.0.9-0.62.el3, seamonkey-chat 1.0.9-0.62.el3, seamonkey-mail 1.0.9-0.62.el3, seamonkey-nspr 1.0.9-0.62.el3, seamonkey-js-debugger 1.0.9-0.62.el3, +1 more Red Hat Enterprise Linux AS version 4 firefox 3.6.11-4.el4_8, seamonkey 1.0.9-65.el4_8, thunderbird 1.5.0.12-33.el4, seamonkey-chat 1.0.9-65.el4_8, seamonkey-mail 1.0.9-65.el4_8, seamonkey-js-debugger 1.0.9-65.el4_8, +1 morefixed: vendor fix RHSA-2010:0810
-
Red Hat Enterprise Linux Desktop (v. 5 client) xulrunner 1.9.2.11-4.el5_5, thunderbird 2.0.0.24-10.el5_5fixed: vendor fix RHSA-2010:0812
-
Red Hat Enterprise Linux Desktop (v. 6) firefox 3.6.12-1.el6_0, thunderbird 3.1.6-1.el6_0, xulrunner 1.9.2.12-1.el6_0 Red Hat Enterprise Linux Desktop Optional (v. 6) xulrunner 1.9.2.12-1.el6_0fixed: vendor fix RHSA-2010:0861
-
Red Hat Enterprise Linux Desktop version 4 firefox 3.6.11-4.el4_8, seamonkey 1.0.9-65.el4_8, thunderbird 1.5.0.12-33.el4, seamonkey-chat 1.0.9-65.el4_8, seamonkey-mail 1.0.9-65.el4_8, seamonkey-js-debugger 1.0.9-65.el4_8, +1 morefixed: vendor fix RHSA-2010:0810
-
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xulrunner 1.9.2.11-4.el5_5fixed: vendor fix RHSA-2010:0809
-
Red Hat Enterprise Linux ES version 3 seamonkey 1.0.9-0.62.el3, seamonkey-nss 1.0.9-0.62.el3, seamonkey-chat 1.0.9-0.62.el3, seamonkey-mail 1.0.9-0.62.el3, seamonkey-nspr 1.0.9-0.62.el3, seamonkey-js-debugger 1.0.9-0.62.el3, +1 more Red Hat Enterprise Linux ES version 4 firefox 3.6.11-4.el4_8, seamonkey 1.0.9-65.el4_8, thunderbird 1.5.0.12-33.el4, seamonkey-chat 1.0.9-65.el4_8, seamonkey-mail 1.0.9-65.el4_8, seamonkey-js-debugger 1.0.9-65.el4_8, +1 morefixed: vendor fix RHSA-2010:0810
show 4 moreshow fewer
-
Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox 3.6.12-1.el6_0, xulrunner 1.9.2.12-1.el6_0fixed: vendor fix RHSA-2010:0861
-
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird 2.0.0.24-10.el5_5fixed: vendor fix RHSA-2010:0812
-
Red Hat Enterprise Linux Server (v. 6) firefox 3.6.12-1.el6_0, xulrunner 1.9.2.12-1.el6_0 Red Hat Enterprise Linux Server Optional (v. 6) thunderbird 3.1.6-1.el6_0, xulrunner 1.9.2.12-1.el6_0 Red Hat Enterprise Linux Workstation (v. 6) firefox 3.6.12-1.el6_0, thunderbird 3.1.6-1.el6_0, xulrunner 1.9.2.12-1.el6_0 Red Hat Enterprise Linux Workstation Optional (v. 6) xulrunner 1.9.2.12-1.el6_0fixed: vendor fix RHSA-2010:0861
-
Red Hat Enterprise Linux WS version 3 seamonkey 1.0.9-0.62.el3, seamonkey-nss 1.0.9-0.62.el3, seamonkey-chat 1.0.9-0.62.el3, seamonkey-mail 1.0.9-0.62.el3, seamonkey-nspr 1.0.9-0.62.el3, seamonkey-js-debugger 1.0.9-0.62.el3, +1 more Red Hat Enterprise Linux WS version 4 firefox 3.6.11-4.el4_8, seamonkey 1.0.9-65.el4_8, thunderbird 1.5.0.12-33.el4, seamonkey-chat 1.0.9-65.el4_8, seamonkey-mail 1.0.9-65.el4_8, seamonkey-js-debugger 1.0.9-65.el4_8, +1 morefixed: vendor fix RHSA-2010:0810
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (Metasploit exploit/windows/browser/mozilla_interleaved_write)
- Published
- CISA SSVC: exploitation active
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 13 mo ago
- Patch by
- 2025-10-27 (12 mo ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Mozilla, Multiple Products
- CISA name
- Mozilla Multiple Products Remote Code Execution Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 13 mo ago
Exploit prediction
83.16% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/windows/browser/mozilla_interleaved_write Mozilla Firefox Interleaved document.write/appendChild Memory Corruption metasploit exploit, normal rank, 2010-10-25
- EDB-16509 Mozilla Firefox - Interleaving 'document.write' / 'appendChild' (Metasploit) remote, 2011-02-22
- EDB-15352 Mozilla Firefox 3.6.8 < 3.6.11 - Interleaving 'document.write' / 'appendChild' Remote Overflow remote, 2010-10-29
- EDB-15342 Mozilla Firefox - Simplified Memory Corruption (PoC) dos, 2010-10-28
- EDB-15341 Mozilla Firefox - Interleaving 'document.write' / 'appendChild' Denial of Service dos, 2010-10-28
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
exploit-db.com
/exploits/15341
exploit
-
exploit-db.com
/exploits/15352
exploit
-
exploit-db.com
/exploits/15342
exploit
-
rhn.redhat.com
/errata/RHSA-2010-0812.html
vendor-advisory
-
redhat.com
/support/errata/RHSA-2010-0896.html
vendor-advisory, third-party-advisory
-
redhat.com
/support/errata/RHSA-2010-0808.html
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2010-November/050233.html
vendor-advisory, third-party-advisory
-
ubuntu.com
/usn/USN-1011-3
vendor-advisory
-
ubuntu.com
/usn/usn-1011-1
vendor-advisory
-
ubuntu.com
/usn/USN-1011-2
vendor-advisory
-
redhat.com
/support/errata/RHSA-2010-0809.html
vendor-advisory, third-party-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2010:219
vendor-advisory, third-party-advisory
-
debian.org
/security/2010/dsa-2124
vendor-advisory, third-party-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2010:213
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2010-October/050061.html
vendor-advisory, third-party-advisory
-
slackware.com
/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.556706
vendor-advisory, third-party-advisory
-
redhat.com
/support/errata/RHSA-2010-0810.html
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2010-October/050077.html
vendor-advisory, third-party-advisory
-
redhat.com
/support/errata/RHSA-2010-0861.html
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2010-October/050154.html
vendor-advisory, third-party-advisory
-
vupen.com
/english/advisories/2010/2837
vdb-entry, vendor-advisory
-
secunia.com
/advisories/41965
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/41975
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/41761
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/41969
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/42867
third-party-advisory, vendor-advisory
-
blog.mozilla.com
/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/
vendor-advisory
-
vupen.com
/english/advisories/2010/2857
vdb-entry, vendor-advisory
-
vupen.com
/english/advisories/2011/0061
vdb-entry, vendor-advisory
-
secunia.com
/advisories/41966
vendor-advisory
-
secunia.com
/advisories/42003
vendor-advisory
-
secunia.com
/advisories/42008
vendor-advisory
-
secunia.com
/advisories/42043
vendor-advisory
-
vupen.com
/english/advisories/2010/2864
vendor-advisory
-
vupen.com
/english/advisories/2010/2871
vendor-advisory
-
securityfocus.com
/bid/44425
vdb-entry, broken-link
- bugzilla.mozilla.org /show_bug.cgi?id=607222#c53
- bugzilla.redhat.com /show_bug.cgi?id=646997
-
support.avaya.com
/css/P8/documents/100114335
third-party-advisory
-
securitytracker.com
/id?1024651
vdb-entry
- bugzilla.mozilla.org /show_bug.cgi?id=607222
-
norman.com
/about_norman/press_center/news_archive/2010/129223/en?utm_source=twitterfeed&utm_medium=twitter
product
-
blogs.sun.com
/security/entry/multiple_vulnerabilities_in_mozilla_firefox
broken-link
-
norman.com
/about_norman/press_center/news_archive/2010/129223/
broken-link
-
securitytracker.com
/id?1024650
vdb-entry
-
support.avaya.com
/css/P8/documents/100114329
third-party-advisory
-
isc.sans.edu
/diary.html?storyid=9817
press/media-coverage
-
mozilla.org
/security/announce/2010/mfsa2010-73.html
third-party-advisory
-
norman.com
/security_center/virus_description_archive/129146/
broken-link
Sources
- CVE List CVE-2010-3765
- NVD CVE-2010-3765
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.