製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の Mozilla 製品における任意のコードを実行される脆弱性

タイトル	複数の Mozilla 製品における任意のコードを実行される脆弱性
概要	複数の Mozilla 製品には、nsCSSFrameConstructor::ContentAppended、appendChild method、不正なインデックストラッキングおよび複数のフレーム作成に関する処理に不備があるため、JavaScript が有効の際、任意のコードを実行される脆弱性が存在します。
想定される影響	第三者により、任意のコードを実行される可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2010年10月27日0:00
登録日	2010年11月16日14:48
最終更新日	2011年5月18日10:33

CVSS2.0 : 危険
スコア	9.3
ベクター	AV:N/AC:M/Au:N/C:C/I:C/A:C

影響を受けるシステム

レッドハット

Red Hat Enterprise Linux 3 (as)

Red Hat Enterprise Linux 3 (es)

Red Hat Enterprise Linux 3 (ws)

Red Hat Enterprise Linux 4 (as)

Red Hat Enterprise Linux 4 (es)

Red Hat Enterprise Linux 4 (ws)

Red Hat Enterprise Linux 4.8 (as)

Red Hat Enterprise Linux 4.8 (es)

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 3.0

Red Hat Enterprise Linux Desktop 4.0

Red Hat Enterprise Linux Desktop 5.0 (client)

Red Hat Enterprise Linux Desktop 6

Red Hat Enterprise Linux HPC Node 6

Red Hat Enterprise Linux Server 6

Red Hat Enterprise Linux Workstation 6

RHEL Desktop Workstation 5 (client)

RHEL Optional Productivity Applications 5 (server)

オラクル

OpenSolaris

Oracle Solaris 10

Oracle Solaris 11 Express

Mozilla Foundation

Mozilla Firefox 3.5.15 未満

Mozilla Firefox 3.6.12 未満

Mozilla SeaMonkey 2.0.10 未満

Mozilla Thunderbird 3.0.10 未満

Mozilla Thunderbird 3.1.6 未満

サイバートラスト株式会社

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

Asianux Server 3.0

Asianux Server 3.0 (x86-64)

Asianux Server 4.0

Asianux Server 4.0 (x86-64)

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-3765	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3765
National Vulnerability Database (NVD)
2	CVE-2010-3765	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3765

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	名前	URL
Asianux Technical Support Network
1	xulrunner-1.9.2.11-4.0.1.AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=1292
MIRACLE LINUX アップデート情報
2	2150	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2150
3	2151	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2151
Mozilla Foundation Security Advisory
4	MFSA2010-73	http://www.mozilla.org/security/announce/2010/mfsa2010-73.html
Mozilla Foundation セキュリティアドバイザリ
5	MFSA2010-73	http://www.mozilla-japan.org/security/announce/2010/mfsa2010-73.html
Red Hat Security Advisory
6	RHSA-2010:0808	https://rhn.redhat.com/errata/RHSA-2010-0808.html
7	RHSA-2010:0809	https://rhn.redhat.com/errata/RHSA-2010-0809.html
8	RHSA-2010:0810	https://rhn.redhat.com/errata/RHSA-2010-0810.html
9	RHSA-2010:0812	https://rhn.redhat.com/errata/RHSA-2010-0812.html
10	RHSA-2010:0861	https://rhn.redhat.com/errata/RHSA-2010-0861.html
11	RHSA-2010:0896	https://rhn.redhat.com/errata/RHSA-2010-0896.html
SECURITY BLOG
12	multiple_vulnerabilities_in_mozilla_firefox	http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
13	multiple_vulnerabilities_in_mozilla_thunderbird1	http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_thunderbird1

その他

No	名前	URL
Secunia Advisory
1	SA41957	http://secunia.com/advisories/41957
2	SA41975	http://secunia.com/advisories/41975
SecurityFocus
3	44425	http://www.securityfocus.com/bid/44425
VUPEN Security
4	VUPEN/ADV-2010-2782	http://www.vupen.com/english/advisories/2010/2782

変更履歴

No	変更内容	変更日
0	[2010年11月16日] 掲載 [2010年12月07日] 影響を受けるシステム：レッドハット (RHSA-2010:0861) の情報を追加影響を受けるシステム：レッドハット (RHSA-2010:0896) の情報を追加ベンダ情報：レッドハット (RHSA-2010:0861) を追加ベンダ情報：レッドハット (RHSA-2010:0896) を追加 [2011年01月27日] 影響を受けるシステム：オラクル (multiple_vulnerabilities_in_mozilla_firefox) の情報を追加ベンダ情報：オラクル (multiple_vulnerabilities_in_mozilla_firefox) を追加 [2011年05月18日] 影響を受けるシステム：オラクル (multiple_vulnerabilities_in_mozilla_thunderbird1) の情報を追加ベンダ情報：オラクル (multiple_vulnerabilities_in_mozilla_thunderbird1) を追加	2018年2月17日10:37

NVD脆弱性情報

CVE-2010-3765

概要	Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.
公表日	2010年10月28日9:00
登録日	2021年1月29日11:06
最終更新日	2024年11月21日10:19

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:mozilla:firefox:3.5.3:::::::*
cpe:2.3:a:mozilla:firefox:3.5.6:::::::*
cpe:2.3:a:mozilla:firefox:3.5:::::::*
cpe:2.3:a:mozilla:firefox:3.5.5:::::::*
cpe:2.3:a:mozilla:firefox:3.5.9:::::::*
cpe:2.3:a:mozilla:firefox:3.5.4:::::::*
cpe:2.3:a:mozilla:firefox:3.5.7:::::::*
cpe:2.3:a:mozilla:firefox:3.5.11:::::::*
cpe:2.3:a:mozilla:firefox:3.5.14:::::::*
cpe:2.3:a:mozilla:firefox:3.5.10:::::::*
cpe:2.3:a:mozilla:firefox:3.5.1:::::::*
cpe:2.3:a:mozilla:firefox:3.5.2:::::::*
cpe:2.3:a:mozilla:firefox:3.5.12:::::::*
cpe:2.3:a:mozilla:firefox:3.5.13:::::::*
cpe:2.3:a:mozilla:firefox:3.5.8:::::::*

構成2	以上	以下	より上	未満
cpe:2.3:a:mozilla:firefox:3.6.2:::::::*
cpe:2.3:a:mozilla:firefox:3.6.3:::::::*
cpe:2.3:a:mozilla:firefox:3.6.11:::::::*
cpe:2.3:a:mozilla:firefox:3.6.8:::::::*
cpe:2.3:a:mozilla:firefox:3.6.9:::::::*
cpe:2.3:a:mozilla:firefox:3.6.6:::::::*
cpe:2.3:a:mozilla:firefox:3.6.10:::::::*
cpe:2.3:a:mozilla:firefox:3.6.7:::::::*
cpe:2.3:a:mozilla:firefox:3.6.4:::::::*
cpe:2.3:a:mozilla:firefox:3.6:::::::*

構成3	以上	以下	より上	未満
cpe:2.3:a:mozilla:thunderbird:3.0.8:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.5:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.9:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.1:::::::*
cpe:2.3:a:mozilla:thunderbird:3.1.2:::::::*
cpe:2.3:a:mozilla:thunderbird:3.1.1:::::::*
cpe:2.3:a:mozilla:thunderbird:3.1.4:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.7:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.6:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.3:::::::*
cpe:2.3:a:mozilla:thunderbird:3.1.5:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.4:::::::*
cpe:2.3:a:mozilla:thunderbird:3.1.3:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.2:::::::*

構成4	以上	以下	より上	未満
cpe:2.3:a:mozilla:seamonkey:2.0.4:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0.3:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0.2:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2::::::
cpe:2.3:a:mozilla:seamonkey:2.0.8:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:rc2::::::
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3::::::
cpe:2.3:a:mozilla:seamonkey:2.0:beta_2::::::
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1::::::
cpe:2.3:a:mozilla:seamonkey:2.0.9:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0.1:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0.7:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:beta_1::::::
cpe:2.3:a:mozilla:seamonkey:2.0.5:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:rc1::::::
cpe:2.3:a:mozilla:seamonkey:2.0.6:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:::::::*

関連情報、対策とツール

No	URL	タグ
1	http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/	Vendor Advisory
2	http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/	Vendor Advisory
3	http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
4	http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
5	http://isc.sans.edu/diary.html?storyid=9817
6	http://isc.sans.edu/diary.html?storyid=9817
7	http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050233.html
8	http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050233.html
9	http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050061.html
10	http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050061.html
11	http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html
12	http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html
13	http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
14	http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
15	http://norman.com/about_norman/press_center/news_archive/2010/129223/en?utm_source=twitterfeed&utm_medium=twitter
16	http://norman.com/about_norman/press_center/news_archive/2010/129223/en?utm_source=twitterfeed&utm_medium=twitter
17	http://secunia.com/advisories/41761	Vendor Advisory
18	http://secunia.com/advisories/41761	Vendor Advisory
19	http://secunia.com/advisories/41965	Vendor Advisory
20	http://secunia.com/advisories/41965	Vendor Advisory
21	http://secunia.com/advisories/41966	Vendor Advisory
22	http://secunia.com/advisories/41966	Vendor Advisory
23	http://secunia.com/advisories/41969	Vendor Advisory
24	http://secunia.com/advisories/41969	Vendor Advisory
25	http://secunia.com/advisories/41975	Vendor Advisory
26	http://secunia.com/advisories/41975	Vendor Advisory
27	http://secunia.com/advisories/42003	Vendor Advisory
28	http://secunia.com/advisories/42003	Vendor Advisory
29	http://secunia.com/advisories/42008	Vendor Advisory
30	http://secunia.com/advisories/42008	Vendor Advisory
31	http://secunia.com/advisories/42043	Vendor Advisory
32	http://secunia.com/advisories/42043	Vendor Advisory
33	http://secunia.com/advisories/42867	Vendor Advisory
34	http://secunia.com/advisories/42867	Vendor Advisory
35	http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.556706
36	http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.556706
37	http://support.avaya.com/css/P8/documents/100114329
38	http://support.avaya.com/css/P8/documents/100114329
39	http://support.avaya.com/css/P8/documents/100114335
40	http://support.avaya.com/css/P8/documents/100114335
41	http://www.debian.org/security/2010/dsa-2124
42	http://www.debian.org/security/2010/dsa-2124
43	http://www.exploit-db.com/exploits/15341	Exploit
44	http://www.exploit-db.com/exploits/15341	Exploit
45	http://www.exploit-db.com/exploits/15342	Exploit
46	http://www.exploit-db.com/exploits/15342	Exploit
47	http://www.exploit-db.com/exploits/15352	Exploit
48	http://www.exploit-db.com/exploits/15352	Exploit
49	http://www.mandriva.com/security/advisories?name=MDVSA-2010:213
50	http://www.mandriva.com/security/advisories?name=MDVSA-2010:213
51	http://www.mandriva.com/security/advisories?name=MDVSA-2010:219
52	http://www.mandriva.com/security/advisories?name=MDVSA-2010:219
53	http://www.mozilla.org/security/announce/2010/mfsa2010-73.html
54	http://www.mozilla.org/security/announce/2010/mfsa2010-73.html
55	http://www.norman.com/about_norman/press_center/news_archive/2010/129223/
56	http://www.norman.com/about_norman/press_center/news_archive/2010/129223/
57	http://www.norman.com/security_center/virus_description_archive/129146/
58	http://www.norman.com/security_center/virus_description_archive/129146/
59	http://www.redhat.com/support/errata/RHSA-2010-0808.html
60	http://www.redhat.com/support/errata/RHSA-2010-0808.html
61	http://www.redhat.com/support/errata/RHSA-2010-0809.html
62	http://www.redhat.com/support/errata/RHSA-2010-0809.html
63	http://www.redhat.com/support/errata/RHSA-2010-0810.html
64	http://www.redhat.com/support/errata/RHSA-2010-0810.html
65	http://www.redhat.com/support/errata/RHSA-2010-0861.html
66	http://www.redhat.com/support/errata/RHSA-2010-0861.html
67	http://www.redhat.com/support/errata/RHSA-2010-0896.html
68	http://www.redhat.com/support/errata/RHSA-2010-0896.html
69	http://www.securityfocus.com/bid/44425
70	http://www.securityfocus.com/bid/44425
71	http://www.securitytracker.com/id?1024645
72	http://www.securitytracker.com/id?1024645
73	http://www.securitytracker.com/id?1024650
74	http://www.securitytracker.com/id?1024650
75	http://www.securitytracker.com/id?1024651
76	http://www.securitytracker.com/id?1024651
77	http://www.ubuntu.com/usn/usn-1011-1
78	http://www.ubuntu.com/usn/usn-1011-1
79	http://www.ubuntu.com/usn/USN-1011-2
80	http://www.ubuntu.com/usn/USN-1011-2
81	http://www.ubuntu.com/usn/USN-1011-3
82	http://www.ubuntu.com/usn/USN-1011-3
83	http://www.vupen.com/english/advisories/2010/2837	Vendor Advisory
84	http://www.vupen.com/english/advisories/2010/2837	Vendor Advisory
85	http://www.vupen.com/english/advisories/2010/2857	Vendor Advisory
86	http://www.vupen.com/english/advisories/2010/2857	Vendor Advisory
87	http://www.vupen.com/english/advisories/2010/2864	Vendor Advisory
88	http://www.vupen.com/english/advisories/2010/2864	Vendor Advisory
89	http://www.vupen.com/english/advisories/2010/2871	Vendor Advisory
90	http://www.vupen.com/english/advisories/2010/2871	Vendor Advisory
91	http://www.vupen.com/english/advisories/2011/0061	Vendor Advisory
92	http://www.vupen.com/english/advisories/2011/0061	Vendor Advisory
93	https://bugzilla.mozilla.org/show_bug.cgi?id=607222
94	https://bugzilla.mozilla.org/show_bug.cgi?id=607222
95	https://bugzilla.mozilla.org/show_bug.cgi?id=607222#c53
96	https://bugzilla.mozilla.org/show_bug.cgi?id=607222#c53
97	https://bugzilla.redhat.com/show_bug.cgi?id=646997
98	https://bugzilla.redhat.com/show_bug.cgi?id=646997
99	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12108
100	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12108
101	https://rhn.redhat.com/errata/RHSA-2010-0812.html
102	https://rhn.redhat.com/errata/RHSA-2010-0812.html

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

構成1	以上	以下	より上	未満
cpe:2.3:a:mozilla:firefox:3.5.3:::::::*
cpe:2.3:a:mozilla:firefox:3.5.6:::::::*
cpe:2.3:a:mozilla:firefox:3.5:::::::*
cpe:2.3:a:mozilla:firefox:3.5.5:::::::*
cpe:2.3:a:mozilla:firefox:3.5.9:::::::*
cpe:2.3:a:mozilla:firefox:3.5.4:::::::*
cpe:2.3:a:mozilla:firefox:3.5.7:::::::*
cpe:2.3:a:mozilla:firefox:3.5.11:::::::*
cpe:2.3:a:mozilla:firefox:3.5.14:::::::*
cpe:2.3:a:mozilla:firefox:3.5.10:::::::*
cpe:2.3:a:mozilla:firefox:3.5.1:::::::*
cpe:2.3:a:mozilla:firefox:3.5.2:::::::*
cpe:2.3:a:mozilla:firefox:3.5.12:::::::*
cpe:2.3:a:mozilla:firefox:3.5.13:::::::*
cpe:2.3:a:mozilla:firefox:3.5.8:::::::*

構成2	以上	以下	より上	未満
cpe:2.3:a:mozilla:firefox:3.6.2:::::::*
cpe:2.3:a:mozilla:firefox:3.6.3:::::::*
cpe:2.3:a:mozilla:firefox:3.6.11:::::::*
cpe:2.3:a:mozilla:firefox:3.6.8:::::::*
cpe:2.3:a:mozilla:firefox:3.6.9:::::::*
cpe:2.3:a:mozilla:firefox:3.6.6:::::::*
cpe:2.3:a:mozilla:firefox:3.6.10:::::::*
cpe:2.3:a:mozilla:firefox:3.6.7:::::::*
cpe:2.3:a:mozilla:firefox:3.6.4:::::::*
cpe:2.3:a:mozilla:firefox:3.6:::::::*

構成3	以上	以下	より上	未満
cpe:2.3:a:mozilla:thunderbird:3.0.8:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.5:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.9:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.1:::::::*
cpe:2.3:a:mozilla:thunderbird:3.1.2:::::::*
cpe:2.3:a:mozilla:thunderbird:3.1.1:::::::*
cpe:2.3:a:mozilla:thunderbird:3.1.4:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.7:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.6:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.3:::::::*
cpe:2.3:a:mozilla:thunderbird:3.1.5:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.4:::::::*
cpe:2.3:a:mozilla:thunderbird:3.1.3:::::::*
cpe:2.3:a:mozilla:thunderbird:3.0.2:::::::*

構成4	以上	以下	より上	未満
cpe:2.3:a:mozilla:seamonkey:2.0.4:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0.3:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0.2:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2::::::
cpe:2.3:a:mozilla:seamonkey:2.0.8:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:rc2::::::
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3::::::
cpe:2.3:a:mozilla:seamonkey:2.0:beta_2::::::
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1::::::
cpe:2.3:a:mozilla:seamonkey:2.0.9:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0.1:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0.7:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:beta_1::::::
cpe:2.3:a:mozilla:seamonkey:2.0.5:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:rc1::::::
cpe:2.3:a:mozilla:seamonkey:2.0.6:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:::::::*