CVE-2010-2753

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via a large selection attribute in a XUL tree element, which triggers a use-after-free.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190 CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.htmlMailing List, Third Party Advisory
http://www.mozilla.org/security/announce/2010/mfsa2010-40.htmlVendor Advisory
http://www.securityfocus.com/archive/1/512510Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/41853Broken Link, Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-10-131/Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=571106Exploit, Issue Tracking
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10958Broken Link
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.htmlMailing List, Third Party Advisory
http://www.mozilla.org/security/announce/2010/mfsa2010-40.htmlVendor Advisory
http://www.securityfocus.com/archive/1/512510Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/41853Broken Link, Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-10-131/Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=571106Exploit, Issue Tracking
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10958Broken Link

Timeline

Published: Jul 30, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-27545.0dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before CVE-2010-275510.0layout/generic/nsObjectFrame.cpp in Mozilla Firefox 3.6.7 does not properly free memory in the parameter array of a plugin instance, which a CVE-2010-27565.0Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 allows remote attackers to deter CVE-2010-27576.5The sudo feature in Bugzilla 2.22rc1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 does not properly send i CVE-2010-27585.0Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 generates different error messages depending CVE-2010-27594.0Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2, when PostgreSQL is used, does not properly h CVE-2010-27609.3Use-after-free vulnerability in the nsTreeSelection function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0 CVE-2010-27614.3The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME CVE-2010-27626.8The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird CVE-2010-27634.3The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3 CVE-2010-27644.3Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not pro CVE-2010-27659.3Integer overflow in the FRAMESET element implementation in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 an