Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade seamonkey-mailUpgrade firefoxUpgrade thunderbirdUpgrade seamonkey-chatUpgrade seamonkey-nsprUpgrade seamonkey-dom-inspectorUpgrade seamonkey-nss-develUpgrade seamonkeyUpgrade seamonkey-develUpgrade xulrunner-develUpgrade seamonkey-js-debuggerUpgrade xulrunnerUpgrade seamonkey-nssUpgrade seamonkey-nspr-devel | Dec 1, 2016 | Oct 27, 2010 |
| Freebsd | — | Upgrade thunderbirdUpgrade firefoxUpgrade linux-firefox-develUpgrade seamonkeyUpgrade libxulUpgrade linux-firefoxUpgrade linux-thunderbirdUpgrade linux-seamonkey | Dec 10, 2025 | Oct 28, 2010 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade mail-client/mozilla-thunderbird.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/thunderbird-bin.Upgrade www-client/icecat.Upgrade net-libs/xulrunner.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/seamonkey.Upgrade www-client/firefox.Upgrade www-client/firefox-bin.Upgrade dev-libs/nss.Upgrade www-client/seamonkey-bin.Upgrade www-client/mozilla-firefox.Upgrade www-client/mozilla-firefox-bin. | Oct 30, 2017 | Oct 27, 2010 |
| Mfsa2010 73 | — | Upgrade to Mozilla Firefox version 3.5.15Upgrade to Mozilla Firefox version 3.6.12 | Jun 14, 2012 | Oct 27, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.10 | Feb 3, 2012 | Oct 27, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.1.6Upgrade to Mozilla Thunderbird version 3.0.10 | Feb 22, 2012 | Oct 27, 2010 |
| Oracle_linux | — | Upgrade xulrunnerUpgrade xulrunner-devel | Oct 16, 2024 | Oct 27, 2010 |
| Suse | — | Upgrade mozilla-xulrunner191-32bitUpgrade libfreebl3Upgrade mozilla-xulrunner191Upgrade mozilla-xulrunner190-x86Upgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner190-gnomevfsUpgrade gconf2-32bitUpgrade gconf2Upgrade mozilla-xulrunner192-translations-32bitUpgrade libidl-x86Upgrade MozillaThunderbird-translations-otherUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-nssUpgrade MozillaFirefox-branding-SLEDUpgrade libfreebl3-x86Upgrade orbit2Upgrade MozillaThunderbird-develUpgrade mozilla-xulrunner192-x86Upgrade MozillaFirefox-translations-otherUpgrade orbit2-x86Upgrade MozillaFirefox-develUpgrade mozilla-xulrunner191-gnomevfsUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-xulrunner192-gnomeUpgrade gconf2-x86Upgrade mozilla-xulrunner190-translationsUpgrade mozilla-nss-x86Upgrade mozilla-xulrunner192-translationsUpgrade MozillaFirefox-translations-commonUpgrade mozilla-xulrunner192-gnome-32bitUpgrade mozilla-xulrunner192-develUpgrade mozilla-xulrunner192Upgrade mozilla-nsprUpgrade mozilla-xulrunner190Upgrade mozilla-nss-toolsUpgrade mozilla-nss-32bitUpgrade libidl-32bitUpgrade libidlUpgrade mozilla-nspr-32bitUpgrade mozilla-nspr-x86Upgrade MozillaFirefox-translationsUpgrade libfreebl3-32bitUpgrade MozillaFirefoxUpgrade mozilla-xulrunner191-x86Upgrade mozilla-xulrunner192-32bitUpgrade orbit2-32bit | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade abrowserUpgrade xulrunner-1.9.2Upgrade xulrunner-1.9.1Upgrade thunderbirdUpgrade firefox-3.0Upgrade firefox-3.5Upgrade firefox | Nov 8, 2024 | Oct 28, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub