AEGLIX vulnerability intelligence
CVE-2010-3765
CRITICAL · CVSS 9.8 · Analyzed
Published: 2010-10-28 · Updated: 2026-06-16 · Source: NVD
Vulnerability overview
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
Severity and scoring
- CVSS score
- 9.8 · CRITICAL
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-119
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Mozilla · Multiple Products
- Added to catalog
- 2025-10-06
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CISA remediation due date
- 2025-10-27
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.11:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.12:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.13:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.5.14:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.0.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:3.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/
Vendor Advisory
- http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
Broken Link
- http://isc.sans.edu/diary.html?storyid=9817
Press/Media Coverage
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050233.html
Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050061.html
Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html
Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
Third Party Advisory
- http://norman.com/about_norman/press_center/news_archive/2010/129223/en?utm_source=twitterfeed&utm_medium=twitter
Product
- http://secunia.com/advisories/41761
Vendor Advisory
- http://secunia.com/advisories/41965
Vendor Advisory
- http://secunia.com/advisories/41966
Vendor Advisory
- http://secunia.com/advisories/41969
Vendor Advisory
- http://secunia.com/advisories/41975
Vendor Advisory
- http://secunia.com/advisories/42003
Vendor Advisory
- http://secunia.com/advisories/42008
Vendor Advisory
- http://secunia.com/advisories/42043
Vendor Advisory
- http://secunia.com/advisories/42867
Vendor Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.556706
Third Party Advisory
- http://support.avaya.com/css/P8/documents/100114329
Third Party Advisory
- http://support.avaya.com/css/P8/documents/100114335
Third Party Advisory
- http://www.debian.org/security/2010/dsa-2124
Third Party Advisory
- http://www.exploit-db.com/exploits/15341
Exploit
- http://www.exploit-db.com/exploits/15342
Exploit
- http://www.exploit-db.com/exploits/15352
Exploit
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:213
Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:219
Third Party Advisory
- http://www.mozilla.org/security/announce/2010/mfsa2010-73.html
Third Party Advisory
- http://www.norman.com/about_norman/press_center/news_archive/2010/129223/
Broken Link
- http://www.norman.com/security_center/virus_description_archive/129146/
Broken Link
- http://www.redhat.com/support/errata/RHSA-2010-0808.html
Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0809.html
Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0810.html
Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0861.html
Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0896.html
Third Party Advisory
- http://www.securityfocus.com/bid/44425
Broken Link
- http://www.securitytracker.com/id?1024645
Broken Link
- http://www.securitytracker.com/id?1024650
Broken Link
- http://www.securitytracker.com/id?1024651
Broken Link
- http://www.ubuntu.com/usn/USN-1011-2
Third Party Advisory
- http://www.ubuntu.com/usn/USN-1011-3
Third Party Advisory
- http://www.ubuntu.com/usn/usn-1011-1
Third Party Advisory
- http://www.vupen.com/english/advisories/2010/2837
Vendor Advisory
- http://www.vupen.com/english/advisories/2010/2857
Vendor Advisory
- http://www.vupen.com/english/advisories/2010/2864
Vendor Advisory
- http://www.vupen.com/english/advisories/2010/2871
Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0061
Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=607222
Issue Tracking
- https://bugzilla.mozilla.org/show_bug.cgi?id=607222#c53
Issue Tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=646997
Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12108
Third Party Advisory
- https://rhn.redhat.com/errata/RHSA-2010-0812.html
Third Party Advisory
- http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/
Vendor Advisory
- http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
Broken Link
- http://isc.sans.edu/diary.html?storyid=9817
Press/Media Coverage
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050233.html
Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050061.html
Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html
Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
Third Party Advisory
- http://norman.com/about_norman/press_center/news_archive/2010/129223/en?utm_source=twitterfeed&utm_medium=twitter
Product
- http://secunia.com/advisories/41761
Vendor Advisory
- http://secunia.com/advisories/41965
Vendor Advisory
- http://secunia.com/advisories/41966
Vendor Advisory
- http://secunia.com/advisories/41969
Vendor Advisory
- http://secunia.com/advisories/41975
Vendor Advisory
- http://secunia.com/advisories/42003
Vendor Advisory
- http://secunia.com/advisories/42008
Vendor Advisory
- http://secunia.com/advisories/42043
Vendor Advisory
- http://secunia.com/advisories/42867
Vendor Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.556706
Third Party Advisory
- http://support.avaya.com/css/P8/documents/100114329
Third Party Advisory
- http://support.avaya.com/css/P8/documents/100114335
Third Party Advisory
- http://www.debian.org/security/2010/dsa-2124
Third Party Advisory
- http://www.exploit-db.com/exploits/15341
Exploit
- http://www.exploit-db.com/exploits/15342
Exploit
- http://www.exploit-db.com/exploits/15352
Exploit
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:213
Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:219
Third Party Advisory
- http://www.mozilla.org/security/announce/2010/mfsa2010-73.html
Third Party Advisory
- http://www.norman.com/about_norman/press_center/news_archive/2010/129223/
Broken Link
- http://www.norman.com/security_center/virus_description_archive/129146/
Broken Link
- http://www.redhat.com/support/errata/RHSA-2010-0808.html
Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0809.html
Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0810.html
Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0861.html
Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0896.html
Third Party Advisory
- http://www.securityfocus.com/bid/44425
Broken Link
- http://www.securitytracker.com/id?1024645
Broken Link
- http://www.securitytracker.com/id?1024650
Broken Link
- http://www.securitytracker.com/id?1024651
Broken Link
- http://www.ubuntu.com/usn/USN-1011-2
Third Party Advisory
- http://www.ubuntu.com/usn/USN-1011-3
Third Party Advisory
- http://www.ubuntu.com/usn/usn-1011-1
Third Party Advisory
- http://www.vupen.com/english/advisories/2010/2837
Vendor Advisory
- http://www.vupen.com/english/advisories/2010/2857
Vendor Advisory
- http://www.vupen.com/english/advisories/2010/2864
Vendor Advisory
- http://www.vupen.com/english/advisories/2010/2871
Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0061
Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=607222
Issue Tracking
- https://bugzilla.mozilla.org/show_bug.cgi?id=607222#c53
Issue Tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=646997
Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12108
Third Party Advisory
- https://rhn.redhat.com/errata/RHSA-2010-0812.html
Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3765
US Government Resource