# MA-254.102010: MyCERT Alert - Critical vulnerability in Mozilla Firefox

**Date:** 29 Oct 2010  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-254.102010  
**Advisory ID:** MA-254.102010

---

**1.0 Introduction**
A critical vulnerability (CVE-2010-3765) has been identified in Mozilla Firefox.
This vulnerability allows a remote attacker to execute arbitrary code on a vulnerable version of Mozilla Firefox. User interaction is required where a user must visit a malicious web site, which is embedded with a specially crafted JavaScript file. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system.
MyCERT is aware that the exploit for this vulnerability is available on the Internet at the time of the publication of this advisory. From the exploit sample that we have found, javascript is require to be enabled in order to make the exploitation process more reliable.
**2.0 Impact**
By exploiting this vulnerability, an attacker could execute arbitrary code on vulnerable installations of Mozilla Firefox and gain the same privilege as the user. This vulnerability could be exploited to install malware on the user's computer.
**3.0 Affected Products**
- Mozilla Thunderbird 3.1.5 and earlier version
- Mozilla Thunderbird 3.0.9 and earlier version
- Mozilla SeaMonkey 2.0.9 and earlier version
- Mozilla Firefox 3.6.11 and earlier version
- Mozilla Firefox 3.5.14 and earlier version
**4.0 Recommendation**
Mozilla Foundation has released patches to fix this vulnerability. Update can be downloaded form the following URLs:
- Mozilla Thunderbird : <http://www.mozilla.com/thunderbird/>
- Mozilla Firefox : <http://www.mozilla.com/firefox>
- Mozilla SeaMonkey : <http://www.seamonkey-project.org/releases/>
Users are also recommended to browse the Internet with least privilege user to limit the execution of the malicious file and do not open attachment or browse to unknown website received via email from unknown person.
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#adc0d4cec8dfd9edc0d4cec8dfd983c2dfca83c0d4)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <https://bugzilla.mozilla.org/show_bug.cgi?id=607222#c53>
- <http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/>
- <http://www.securityfocus.com/bid/44425/>