Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade seamonkey-nssUpgrade seamonkey-js-debuggerUpgrade xulrunnerUpgrade xulrunner-develUpgrade seamonkeyUpgrade seamonkey-develUpgrade seamonkey-nss-develUpgrade seamonkey-nspr-develUpgrade seamonkey-mailUpgrade seamonkey-chatUpgrade seamonkey-nsprUpgrade seamonkey-dom-inspectorUpgrade firefoxUpgrade thunderbird | Dec 1, 2016 | Oct 27, 2010 |
| Freebsd | — | Upgrade linux-firefox-develUpgrade thunderbirdUpgrade firefoxUpgrade libxulUpgrade seamonkeyUpgrade linux-firefoxUpgrade linux-thunderbirdUpgrade linux-seamonkey | Dec 10, 2025 | Oct 28, 2010 |
| Gentoo Linux | — | Upgrade net-libs/xulrunner.Upgrade dev-libs/nss.Upgrade www-client/seamonkey.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/icecat.Upgrade www-client/mozilla-firefox-bin.Upgrade www-client/firefox-bin.Upgrade www-client/firefox.Upgrade www-client/mozilla-firefox.Upgrade mail-client/mozilla-thunderbird.Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin.Upgrade net-libs/xulrunner-bin. | Oct 30, 2017 | Oct 27, 2010 |
| Mfsa2010 73 | — | Upgrade to Mozilla Firefox version 3.6.12Upgrade to Mozilla Firefox version 3.5.15 | Jun 14, 2012 | Oct 27, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.10 | Feb 3, 2012 | Oct 27, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.1.6Upgrade to Mozilla Thunderbird version 3.0.10 | Feb 22, 2012 | Oct 27, 2010 |
| Oracle_linux | — | Upgrade xulrunner-develUpgrade xulrunner | Oct 16, 2024 | Oct 27, 2010 |
| Suse | — | Upgrade mozilla-xulrunner192-translationsUpgrade MozillaFirefox-translationsUpgrade MozillaFirefox-translations-commonUpgrade orbit2-32bitUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-xulrunner190-translationsUpgrade libfreebl3-32bitUpgrade mozilla-xulrunner192-gnomeUpgrade libidlUpgrade MozillaFirefoxUpgrade mozilla-nspr-x86Upgrade mozilla-nspr-32bitUpgrade mozilla-xulrunner192-develUpgrade mozilla-nss-x86Upgrade libidl-32bitUpgrade mozilla-nsprUpgrade mozilla-nss-toolsUpgrade mozilla-xulrunner191-x86Upgrade mozilla-nss-32bitUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner192Upgrade mozilla-xulrunner191-gnomevfsUpgrade mozilla-xulrunner192-32bitUpgrade gconf2-x86Upgrade mozilla-xulrunner192-gnome-32bitUpgrade MozillaFirefox-develUpgrade MozillaThunderbirdUpgrade MozillaThunderbird-develUpgrade libfreebl3Upgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbird-translations-commonUpgrade mozilla-xulrunner190-x86Upgrade mozilla-nssUpgrade orbit2-x86Upgrade mozilla-xulrunner191-translationsUpgrade orbit2Upgrade MozillaFirefox-branding-SLEDUpgrade mozilla-xulrunner192-x86Upgrade mozilla-xulrunner191-32bitUpgrade libidl-x86Upgrade MozillaFirefox-translations-otherUpgrade libfreebl3-x86Upgrade mozilla-xulrunner192-translations-32bitUpgrade gconf2Upgrade mozilla-xulrunner190-gnomevfsUpgrade gconf2-32bitUpgrade mozilla-xulrunner191 | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade xulrunner-1.9.2Upgrade abrowserUpgrade xulrunner-1.9.1Upgrade firefoxUpgrade firefox-3.5Upgrade thunderbirdUpgrade firefox-3.0 | Nov 8, 2024 | Oct 28, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub