erroneo.us
Search all guides⌘K

Security Digest · Vulnerability record · Known exploited

CVE-2010-3765: Mozilla Multiple Products Remote Code Execution Vulnerability

Exploited in the wild (CISA KEV). Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to…

CISA KEV · added 2025-10-06 CVSS 9.8 Critical EPSS 83.2% · p99.7

Updated By erroneo.us Security Desk55 references Seen in the digest for Oct 6, 2025

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

  • Yes, if you run Mozilla Multiple Products. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2025-10-06, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2025-10-27; treat that as the outer limit, not the target.
  • EPSS 83.2%, percentile 99.7: FIRST’s model estimates a 83.2% chance of exploitation activity in the next 30 days, higher than 99.7% of all scored CVEs (very high). EPSS is a probability, not a verdict.
  • Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.

What it is

Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.

CISA’s summary

Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.

Weakness type: CWE-119.

Product: Mozilla Multiple Products · Assigned by: mitre · Published: 2010-10-27

Affected and fixed versions

VendorProductAffected versions (per CVE record)
n/an/asee vendor advisory

Severity scores

Scored byCVSSScoreVector
CISA-ADP3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Attack vector: network (remotely reachable)
  • Attack complexity: low
  • Privileges required: none (no login)
  • User interaction: none
  • Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

  • CISA KEV: added 2025-10-06; federal due date 2025-10-27. Known ransomware use: Unknown.
  • CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
  • CISA SSVC assessment: exploitation active, automatable yes, technical impact total.
  • FIRST EPSS (model of 2026-10-21): 83.16% probability of exploitation activity in the next 30 days; percentile 99.7.

Timeline

  • — CVE record published by mitre
  • — Added to CISA’s Known Exploited Vulnerabilities catalog
  • — CVE record last updated
  • — CISA remediation deadline for US federal agencies

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

  1. RHSA-2010:0812 rhn.redhat.com
  2. RHSA-2010:0896 redhat.com
  3. RHSA-2010:0808 redhat.com
  4. FEDORA-2010-17105 lists.fedoraproject.org
  5. USN-1011-3 ubuntu.com
  6. USN-1011-1 ubuntu.com
  7. USN-1011-2 ubuntu.com
  8. RHSA-2010:0809 redhat.com
  9. MDVSA-2010:219 mandriva.com
  10. DSA-2124 debian.org
  11. MDVSA-2010:213 mandriva.com
  12. FEDORA-2010-16883 lists.fedoraproject.org
  13. SSA:2010-305-01 slackware.com
  14. RHSA-2010:0810 redhat.com
  15. FEDORA-2010-16897 lists.fedoraproject.org
  16. RHSA-2010:0861 redhat.com
  17. FEDORA-2010-16885 lists.fedoraproject.org
  18. Listed in CISA KEV notes (mozilla.org) mozilla.org

Vulnerability records

  1. CVE.org record CVE-2010-3765 cve.org
  2. NVD entry CVE-2010-3765 nvd.nist.gov

Government

  1. CISA Known Exploited Vulnerabilities catalog entry cisa.gov

Other references from the CVE record and advisory

  1. 44425 securityfocus.com
  2. bugzilla.mozilla.org bugzilla.mozilla.org
  3. ADV-2010-2837 vupen.com
  4. bugzilla.redhat.com bugzilla.redhat.com
  5. support.avaya.com support.avaya.com
  6. 41965 secunia.com
  7. 41975 secunia.com
  8. 15341 exploit-db.com
  9. 1024651 securitytracker.com
  10. 41761 secunia.com
  11. bugzilla.mozilla.org bugzilla.mozilla.org
  12. norman.com norman.com
  13. 41969 secunia.com
  14. blogs.sun.com blogs.sun.com
  15. norman.com norman.com
  16. 1024650 securitytracker.com
  17. 42867 secunia.com
  18. blog.mozilla.com blog.mozilla.com
  19. ADV-2010-2857 vupen.com
  20. ADV-2011-0061 vupen.com
  21. support.avaya.com support.avaya.com
  22. 1024645 securitytracker.com
  23. 42043 secunia.com
  24. norman.com norman.com
  25. 41966 secunia.com
  26. 42008 secunia.com
  27. ADV-2010-2871 vupen.com
  28. isc.sans.edu isc.sans.edu
  29. mozilla.org mozilla.org
  30. 15352 exploit-db.com
  31. oval:org.mitre.oval:def:12108 oval.cisecurity.org
  32. 42003 secunia.com
  33. 15342 exploit-db.com
  34. ADV-2010-2864 vupen.com

All exploited Mozilla vulnerabilities · Today’s Security Digest