CVE-2010-3765

CVE Details

Release Date:	2010-10-28
Impact:	Critical	What is this?

Description

Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.

See more information about CVE-2010-3765 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	9.3
Vector String:	AV:N/AC:M/Au:N/C:C/I:C/A:C
Version:	2.0
Attack Vector:	Network
Attack Complexity:	Medium
Authentication:	None
Confidentiality Impact:	Complete
Integrity Impact:	Complete
Availability Impact:	Complete

Errata information

Platform	Errata	Release Date
Oracle Enterprise Linux version 3 (seamonkey)	ELSA-2010-0810	2010-10-28
Oracle Enterprise Linux version 4 (firefox)	ELSA-2010-0808	2010-10-28
Oracle Enterprise Linux version 4 (seamonkey)	ELSA-2010-0810	2010-10-28
Oracle Enterprise Linux version 4 (thunderbird)	ELSA-2010-0812	2010-10-29
Oracle Linux version 5 (xulrunner)	ELSA-2010-0809	2010-10-28