Lucene search
MitreCVE-2010-3771HistoryDec 10, 2010 - 7:00 p.m.
CVE-2010-3771
2010-12-1019:00:02
mitre
web.nvd.nist.gov
56
cve-2010-3771
mozilla firefox
seamonkey
code execution
security vulnerability
nvd
CVSS2
6.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
9.5
Confidence
High
EPSS
0.015
Percentile
87.0%
Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle injection of an ISINDEX element into an about:blank page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to redirection to a chrome: URI.
Affected configurations
Node
mozillafirefoxMatch3.6
ORmozillafirefoxMatch3.6.2
ORmozillafirefoxMatch3.6.3
ORmozillafirefoxMatch3.6.4
ORmozillafirefoxMatch3.6.6
ORmozillafirefoxMatch3.6.7
ORmozillafirefoxMatch3.6.8
ORmozillafirefoxMatch3.6.9
ORmozillafirefoxMatch3.6.10
ORmozillafirefoxMatch3.6.11
ORmozillafirefoxMatch3.6.12
Node
mozillaseamonkeyRange≤2.0.10
ORmozillaseamonkeyMatch1.0
ORmozillaseamonkeyMatch1.0alpha
ORmozillaseamonkeyMatch1.0beta
ORmozillaseamonkeyMatch1.0.1
ORmozillaseamonkeyMatch1.0.2
ORmozillaseamonkeyMatch1.0.3
ORmozillaseamonkeyMatch1.0.4
ORmozillaseamonkeyMatch1.0.5
ORmozillaseamonkeyMatch1.0.6
ORmozillaseamonkeyMatch1.0.7
ORmozillaseamonkeyMatch1.0.8
ORmozillaseamonkeyMatch1.0.9
ORmozillaseamonkeyMatch1.1
ORmozillaseamonkeyMatch1.1alpha
ORmozillaseamonkeyMatch1.1beta
ORmozillaseamonkeyMatch1.1.1
ORmozillaseamonkeyMatch1.1.2
ORmozillaseamonkeyMatch1.1.3
ORmozillaseamonkeyMatch1.1.4
ORmozillaseamonkeyMatch1.1.5
ORmozillaseamonkeyMatch1.1.6
ORmozillaseamonkeyMatch1.1.7
ORmozillaseamonkeyMatch1.1.8
ORmozillaseamonkeyMatch1.1.9
ORmozillaseamonkeyMatch1.1.10
ORmozillaseamonkeyMatch1.1.11
ORmozillaseamonkeyMatch1.1.12
ORmozillaseamonkeyMatch1.1.13
ORmozillaseamonkeyMatch1.1.14
ORmozillaseamonkeyMatch1.1.15
ORmozillaseamonkeyMatch1.1.16
ORmozillaseamonkeyMatch1.1.17
ORmozillaseamonkeyMatch1.1.18
ORmozillaseamonkeyMatch1.1.19
ORmozillaseamonkeyMatch1.5.0.8
ORmozillaseamonkeyMatch1.5.0.9
ORmozillaseamonkeyMatch1.5.0.10
ORmozillaseamonkeyMatch2.0
ORmozillaseamonkeyMatch2.0alpha_1
ORmozillaseamonkeyMatch2.0alpha_2
ORmozillaseamonkeyMatch2.0alpha_3
ORmozillaseamonkeyMatch2.0beta_1
ORmozillaseamonkeyMatch2.0beta_2
ORmozillaseamonkeyMatch2.0rc1
ORmozillaseamonkeyMatch2.0rc2
ORmozillaseamonkeyMatch2.0.1
ORmozillaseamonkeyMatch2.0.2
ORmozillaseamonkeyMatch2.0.3
ORmozillaseamonkeyMatch2.0.4
ORmozillaseamonkeyMatch2.0.5
ORmozillaseamonkeyMatch2.0.6
ORmozillaseamonkeyMatch2.0.7
ORmozillaseamonkeyMatch2.0.8
ORmozillaseamonkeyMatch2.0.9
Node
mozillafirefoxRange≤3.5.15
ORmozillafirefoxMatch0.1
ORmozillafirefoxMatch0.2
ORmozillafirefoxMatch0.3
ORmozillafirefoxMatch0.4
ORmozillafirefoxMatch0.5
ORmozillafirefoxMatch0.6
ORmozillafirefoxMatch0.6.1
ORmozillafirefoxMatch0.7
ORmozillafirefoxMatch0.7.1
ORmozillafirefoxMatch0.8
ORmozillafirefoxMatch0.9
ORmozillafirefoxMatch0.9rc
ORmozillafirefoxMatch0.9.1
ORmozillafirefoxMatch0.9.2
ORmozillafirefoxMatch0.9.3
ORmozillafirefoxMatch0.10
ORmozillafirefoxMatch0.10.1
ORmozillafirefoxMatch1.0
ORmozillafirefoxMatch1.0preview_release
ORmozillafirefoxMatch1.0.1
ORmozillafirefoxMatch1.0.2
ORmozillafirefoxMatch1.0.3
ORmozillafirefoxMatch1.0.4
ORmozillafirefoxMatch1.0.5
ORmozillafirefoxMatch1.0.6
ORmozillafirefoxMatch1.0.7
ORmozillafirefoxMatch1.0.8
ORmozillafirefoxMatch1.4.1
ORmozillafirefoxMatch1.5
ORmozillafirefoxMatch1.5beta1
ORmozillafirefoxMatch1.5beta2
ORmozillafirefoxMatch1.5.0.1
ORmozillafirefoxMatch1.5.0.2
ORmozillafirefoxMatch1.5.0.3
ORmozillafirefoxMatch1.5.0.4
ORmozillafirefoxMatch1.5.0.5
ORmozillafirefoxMatch1.5.0.6
ORmozillafirefoxMatch1.5.0.7
ORmozillafirefoxMatch1.5.0.8
ORmozillafirefoxMatch1.5.0.9
ORmozillafirefoxMatch1.5.0.10
ORmozillafirefoxMatch1.5.0.11
ORmozillafirefoxMatch1.5.0.12
ORmozillafirefoxMatch1.5.1
ORmozillafirefoxMatch1.5.2
ORmozillafirefoxMatch1.5.3
ORmozillafirefoxMatch1.5.4
ORmozillafirefoxMatch1.5.5
ORmozillafirefoxMatch1.5.6
ORmozillafirefoxMatch1.5.7
ORmozillafirefoxMatch1.5.8
ORmozillafirefoxMatch1.8
ORmozillafirefoxMatch2.0
ORmozillafirefoxMatch2.0.0.1
ORmozillafirefoxMatch2.0.0.2
ORmozillafirefoxMatch2.0.0.3
ORmozillafirefoxMatch2.0.0.4
ORmozillafirefoxMatch2.0.0.5
ORmozillafirefoxMatch2.0.0.6
ORmozillafirefoxMatch2.0.0.7
ORmozillafirefoxMatch2.0.0.8
ORmozillafirefoxMatch2.0.0.9
ORmozillafirefoxMatch2.0.0.10
ORmozillafirefoxMatch2.0.0.11
ORmozillafirefoxMatch2.0.0.12
ORmozillafirefoxMatch2.0.0.13
ORmozillafirefoxMatch2.0.0.14
ORmozillafirefoxMatch2.0.0.15
ORmozillafirefoxMatch2.0.0.16
ORmozillafirefoxMatch2.0.0.17
ORmozillafirefoxMatch2.0.0.18
ORmozillafirefoxMatch2.0.0.19
ORmozillafirefoxMatch2.0.0.20
ORmozillafirefoxMatch3.0
ORmozillafirefoxMatch3.0.1
ORmozillafirefoxMatch3.0.2
ORmozillafirefoxMatch3.0.3
ORmozillafirefoxMatch3.0.4
ORmozillafirefoxMatch3.0.5
ORmozillafirefoxMatch3.0.6
ORmozillafirefoxMatch3.0.7
ORmozillafirefoxMatch3.0.8
ORmozillafirefoxMatch3.0.9
ORmozillafirefoxMatch3.0.10
ORmozillafirefoxMatch3.0.11
ORmozillafirefoxMatch3.0.12
ORmozillafirefoxMatch3.0.13
ORmozillafirefoxMatch3.0.14
ORmozillafirefoxMatch3.0.15
ORmozillafirefoxMatch3.0.16
ORmozillafirefoxMatch3.0.17
ORmozillafirefoxMatch3.5
ORmozillafirefoxMatch3.5.1
ORmozillafirefoxMatch3.5.2
ORmozillafirefoxMatch3.5.3
ORmozillafirefoxMatch3.5.4
ORmozillafirefoxMatch3.5.5
ORmozillafirefoxMatch3.5.6
ORmozillafirefoxMatch3.5.7
ORmozillafirefoxMatch3.5.8
ORmozillafirefoxMatch3.5.9
ORmozillafirefoxMatch3.5.10
ORmozillafirefoxMatch3.5.11
ORmozillafirefoxMatch3.5.12
ORmozillafirefoxMatch3.5.13
ORmozillafirefoxMatch3.5.14
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mozilla | firefox | 3.6 | cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:* |
| mozilla | firefox | 3.6.2 | cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:* |
| mozilla | firefox | 3.6.3 | cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:* |
| mozilla | firefox | 3.6.4 | cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:* |
| mozilla | firefox | 3.6.6 | cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:* |
| mozilla | firefox | 3.6.7 | cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:* |
| mozilla | firefox | 3.6.8 | cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:* |
| mozilla | firefox | 3.6.9 | cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:* |
| mozilla | firefox | 3.6.10 | cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:* |
| mozilla | firefox | 3.6.11 | cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:* |
References
lists.fedoraproject.org/pipermail/package-announce/2010-December/052022.html
lists.fedoraproject.org/pipermail/package-announce/2010-December/052032.html
lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html
lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html
lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html
secunia.com/advisories/42716
secunia.com/advisories/42818
support.avaya.com/css/P8/documents/100124650
www.debian.org/security/2010/dsa-2132
www.mandriva.com/security/advisories?name=MDVSA-2010:251
www.mozilla.org/security/announce/2010/mfsa2010-76.html
www.redhat.com/support/errata/RHSA-2010-0966.html
www.securityfocus.com/bid/45346
www.securitytracker.com/id?1024848
www.ubuntu.com/usn/USN-1019-1
www.vupen.com/english/advisories/2011/0030
bugzilla.mozilla.org/show_bug.cgi?id=609437
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12343
Related
securityvulns
securityvulns
Mozilla Foundation Security Advisory 2010-76
2010-12-10 00:00:00
Mozilla Firefox / Thinderbird / Seamonkey multiple security vulnerabilities
2010-12-10 00:00:00
prion
prion
Design/Logic Flaw
2010-12-10 19:00:00
nvd
nvd
CVE-2010-3771
2010-12-10 19:00:02
ubuntucve
ubuntucve
CVE-2010-3771
2010-12-09 00:00:00
veracode
veracode
Arbitrary Code Execution
2020-04-10 00:52:31
cvelist
cvelist
CVE-2010-3771
2010-12-10 18:00:00
mozilla
mozilla
openvas
openvas
Mozilla Products Multiple Vulnerabilities (MFSA2010-76, MFSA2010-80, MFSA2010-81, MFSA2010-84) - Windows
2010-12-27 00:00:00
Mozilla Products Multiple Vulnerabilities dec-10 (Windows)
2010-12-27 00:00:00
Debian: Security Advisory (DSA-2132-1)
2011-01-24 00:00:00
nessus
nessus
Debian DSA-2132-1 : xulrunner - several vulnerabilities
2010-12-15 00:00:00
Fedora 14 : firefox-3.6.13-1.fc14 / galeon-2.0.7-36.fc14.1 / gnome-python2-extras-2.25.3-26.fc14.1 / etc (2010-18773)
2010-12-12 00:00:00
Oracle Linux 4 / 5 / 6 : firefox (ELSA-2010-0966)
2013-07-12 00:00:00
debian
debian
[SECURITY] [DSA 2132-1] New xulrunner packages fix several vulnerabilities
2010-12-11 12:03:17
[BSA-013] Security Update for iceweasel
2011-01-02 19:45:28
osv
osv
xulrunner - several vulnerabilities
2010-12-11 00:00:00
fedora
fedora
[SECURITY] Fedora 14 Update: gnome-web-photo-0.9-16.fc14.1
2010-12-10 20:27:49
[SECURITY] Fedora 13 Update: firefox-3.6.13-1.fc13
2010-12-10 20:25:42
[SECURITY] Fedora 14 Update: gnome-python2-extras-2.25.3-26.fc14.1
2010-12-10 20:27:49
oraclelinux
oraclelinux
firefox security update
2010-12-10 00:00:00
centos
centos
firefox security update
2011-01-27 08:53:21
ubuntu
ubuntu
Firefox and Xulrunner vulnerabilities
2010-12-09 00:00:00
redhat
redhat
(RHSA-2010:0966) Critical: firefox security update
2010-12-09 00:00:00
freebsd
freebsd
mozilla -- multiple vulnerabilities
2010-12-09 00:00:00
suse
suse
remote code execution in MozillaFirefox,MozillaThunderbird,Seamonkey
2011-01-05 11:25:44
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2013-01-08 00:00:00
CVSS2
6.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
AI Score
9.5
Confidence
High
EPSS
0.015
Percentile
87.0%
Related for CVE-2010-3771