erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: October 26, 2010

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Most can relax: Firefox CVE-2010-3765: 2010 Zero-Day Added to KEV in 2025. Owners of legacy machines, kiosks or frozen images that still run Firefox 3.5/3.6, Thunderbird 3.0/3.1 or SeaMonkey 2.0 with JavaScript enabled.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Most can relax

· Vulnerability · CVE-2010-3765

Firefox CVE-2010-3765: 2010 Zero-Day Added to KEV in 2025

This is a 2010 bug in Firefox 3.5 and 3.6, fixed within a day and out of support since 2012; anyone on a Firefox, Thunderbird or SeaMonkey release from the last decade is not affected, and any 2010-era copy should be retired.

Must act: Owners of legacy machines, kiosks or frozen images that still run Firefox 3.5/3.6, Thunderbird 3.0/3.1 or SeaMonkey 2.0 with JavaScript enabled.

Can relax: Everyone on a current or even moderately old Firefox, Firefox ESR, Thunderbird or SeaMonkey; every release since Firefox 3.6.12 (October 2010) contains the fix.

  1. Query your software inventory for Firefox, Thunderbird or SeaMonkey versions below 4.0, including copies inside VM templates and kiosk images.
  2. Upgrade any hit to a current Firefox, Firefox ESR, Thunderbird or SeaMonkey release, or uninstall it.
  3. If a legacy application pins a 2010-era Mozilla build, block it from browsing the web and from loading remote content, and plan its replacement.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.