VulnerabilityModified

CVE-2010-1208

Use-after-free vulnerability in the attribute-cloning functionality in the DOM implementation in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to execute arbitrary code via vectors…

HIGH 8.8EPSS 5.15%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 5.15% probability · 92th percentile
CISA KEV: Not listed
Weakness: CWE-416
Affected: mozilla/firefox · mozilla/seamonkey
Source: cve@mitre.org

References

http://www.mozilla.org/security/announce/2010/mfsa2010-35.htmlVendor Advisory
http://www.securityfocus.com/archive/1/512515Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/41849Broken Link, Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-10-134/Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=572986Issue Tracking, Patch
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11740Broken Link
http://www.mozilla.org/security/announce/2010/mfsa2010-35.htmlVendor Advisory
http://www.securityfocus.com/archive/1/512515Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/41849Broken Link, Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-10-134/Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=572986Issue Tracking, Patch
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11740Broken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.