CVE-2010-3765

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 83,2%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada mozilla firefox, mozilla thunderbird +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP. Masuk katalog KEV CISA pada 6 Oktober 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.

Rincian

Terbit di NVD

28 Oktober 2010

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

83,2% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Mozilla Multiple Products Remote Code Execution Vulnerability

Masuk KEV

6 Oktober 2025

Tenggat CISA

27 Oktober 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/ advisory vendor
• http://secunia.com/advisories/41761 advisory vendor
• http://secunia.com/advisories/41965 advisory vendor
• http://secunia.com/advisories/41966 advisory vendor
• http://secunia.com/advisories/41969 advisory vendor
• http://secunia.com/advisories/41975 advisory vendor
• http://secunia.com/advisories/42003 advisory vendor
• http://secunia.com/advisories/42008 advisory vendor
• http://secunia.com/advisories/42043 advisory vendor
• http://secunia.com/advisories/42867 advisory vendor
• http://www.vupen.com/english/advisories/2010/2837 advisory vendor
• http://www.vupen.com/english/advisories/2010/2857 advisory vendor
• http://www.vupen.com/english/advisories/2010/2864 advisory vendor
• http://www.vupen.com/english/advisories/2010/2871 advisory vendor
• http://www.vupen.com/english/advisories/2011/0061 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3765 pemerintah AS
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050233.html advisory pihak ketiga
• http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050061.html advisory pihak ketiga
• http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html advisory pihak ketiga
• http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html advisory pihak ketiga
• http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.556706 advisory pihak ketiga
• http://support.avaya.com/css/P8/documents/100114329 advisory pihak ketiga
• http://support.avaya.com/css/P8/documents/100114335 advisory pihak ketiga
• http://www.debian.org/security/2010/dsa-2124 advisory pihak ketiga
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:213 advisory pihak ketiga