Vulnerability CVE-2010-3765

Vulnerability CVE-2010-3765

Published: 2010-10-27 Modified: 2012-02-13

Description:

Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.

See advisories in our WLB2 database:

	Topic	Author	Date
High	Firefox Memory Corruption Proof of Concept (Simplified)	exploit dev	31.10.2010
High	Firefox Interleaving document.write and appendChild Denial of Service	Daniel Veditz	03.11.2010
High	Firefox 3.6.8 - 3.6.11 Interleaving document.write and appendChild Exploit (From the Wild)	unknown	03.11.2010

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score	Impact Subscore	Exploitability Subscore
9.3/10	10/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Complete	Complete	Complete

Affected software
Mozilla -> Firefox
Mozilla -> Seamonkey
Mozilla -> Thunderbird

References:

https://rhn.redhat.com/errata/RHSA-2010-0812.html

https://bugzilla.redhat.com/show_bug.cgi?id=646997

https://bugzilla.mozilla.org/show_bug.cgi?id=607222#c53

https://bugzilla.mozilla.org/show_bug.cgi?id=607222

http://www.vupen.com/english/advisories/2011/0061

http://www.vupen.com/english/advisories/2010/2871

http://www.vupen.com/english/advisories/2010/2864

http://www.vupen.com/english/advisories/2010/2857

http://www.vupen.com/english/advisories/2010/2837

http://www.ubuntu.com/usn/USN-1011-3

http://www.ubuntu.com/usn/USN-1011-2

http://www.ubuntu.com/usn/usn-1011-1

http://www.securitytracker.com/id?1024651

http://www.securitytracker.com/id?1024650

http://www.securitytracker.com/id?1024645

http://www.securityfocus.com/bid/44425

http://www.redhat.com/support/errata/RHSA-2010-0896.html

http://www.redhat.com/support/errata/RHSA-2010-0861.html

http://www.redhat.com/support/errata/RHSA-2010-0810.html

http://www.redhat.com/support/errata/RHSA-2010-0809.html

http://www.redhat.com/support/errata/RHSA-2010-0808.html

http://www.norman.com/security_center/virus_description_archive/129146/

http://www.norman.com/about_norman/press_center/news_archive/2010/129223/

http://www.mozilla.org/security/announce/2010/mfsa2010-73.html

http://www.mandriva.com/security/advisories?name=MDVSA-2010:219

http://www.mandriva.com/security/advisories?name=MDVSA-2010:213

http://www.exploit-db.com/exploits/15352

http://www.exploit-db.com/exploits/15342

http://www.exploit-db.com/exploits/15341

http://www.debian.org/security/2010/dsa-2124

http://support.avaya.com/css/P8/documents/100114335

http://support.avaya.com/css/P8/documents/100114329

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.556706

http://secunia.com/advisories/42867

http://secunia.com/advisories/42043

http://secunia.com/advisories/42008

http://secunia.com/advisories/42003

http://secunia.com/advisories/41975

http://secunia.com/advisories/41969

http://secunia.com/advisories/41966

http://secunia.com/advisories/41965

http://secunia.com/advisories/41761

http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12108

http://norman.com/about_norman/press_center/news_archive/2010/129223/en?utm_source=twitterfeed&utm_medium=twitter

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050061.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050233.html

http://isc.sans.edu/diary.html?storyid=9817

http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox

http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/

Vulnerability CVE-2010-3765

See advisories in our WLB2 database:

High

Firefox Memory Corruption Proof of Concept (Simplified)

High

Firefox Interleaving document.write and appendChild Denial of Service

High

Firefox 3.6.8 - 3.6.11 Interleaving document.write and appendChild Exploit (From the Wild)

CWE-119

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

9.3/10

10/10

8.6/10

Remote

Medium

No required

Complete

Complete

Complete

Affected software

References: