Mozilla Firefox Remote Heap Buffer Overflow Vulnerability

Publish date: July 21, 2015

Severity: CRITICAL

CVE Identifier: CVE-2010-3343,CVE-2010-3765

Advisory Date: JUL 21, 2015

DESCRIPTION

Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.

TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

SOLUTION

Trend Micro Deep Security DPI Rule Number: 1004493

Trend Micro Deep Security DPI Rule Name: 1004493 - Mozilla Firefox Remote Heap Buffer Overflow Vulnerability

AFFECTED SOFTWARE AND VERSION

Related Vulnerability

December 2010 - Microsoft Releases 17 Security Advisories

Related Malware

HTML_SHELLCOD.SM

Related Web Attack

Multiple Malware, One Exploit: How HTML_SHELLCOD.SM Operates

Featured Stories

$Cloud-native apps$
Abusing Argo CD, Helm, and Artifact Hub: An Analysis of Supply Chain Attacks in Cloud-Native Applications
We provide an overview of cloud-native tools and examine how cybercriminals can exploit their vulnerabilities to launch supply chain attacks.
Read more
$Trends and Shifts in the Underground N-Day Exploit Market$
Trends and Shifts in the Underground N-Day Exploit Market
Our two-year research provides insights into the life cycle of exploits, the types of exploit buyers and sellers, and the business models that are reshaping the underground exploit market.
Read more
$the nightmares of patch management the status quo and beyond$
The Nightmares of Patch Management: The Status Quo and Beyond
We discuss the challenges that organizations face in managing endpoint and server patches.
Read more
$Weak Parts Supply Chain$
Identifying Weak Parts of a Supply Chain
Malicious attacks have consistently been launched on weak points in the supply chain. Like all attacks, these will evolve into more advanced forms. Software development, with multiple phases that could be placed at risk, is particularly vulnerable.
Read more