CVE-2010-3182
published 2010-10-21CVE-2010-3182: A certain application-launch script in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey…
PriorityP420medium6.9CVSS 2.0
AVLACMAuNCCICAC
EPSS
0.29%
20.8th percentile
A certain application-launch script in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 on Linux places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Affected
206 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 3.5.13 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vendor_ubuntu9.3CRITICAL
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2010-10-20·CVSS 9.3
CVE-2010-3176 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Thunderbird could be made to run programs as your login if it opened a
specially crafted file.
Paul Nickerson, Jesse Ruderman, Olli Pettay, Igor Bukanov, Josh Soref, Gary
Kwong, Martijn Wargers, Siddharth Agarwal and Michal Zalewski discovered
various flaws in the browser engine. An attacker could exploit this to
crash Thunderbird or possibly run arbitrary code as the user invoking the
program. (CVE-2010-3175, CVE-2010-3176)
Alexander Miller, Sergey Glazunov, and others discovered several flaws in
the JavaScript engine. If JavaScript were enabled, an attacker could
exploit this to crash Thunderbird or possibly run arbitrary code as the
user invoking the program. (CVE-2010-3179, CVE-2010-3180, CVE-2010-3183)
Eduardo Vela Nava discovered that T
Ubuntu
Firefox and Xulrunner vulnerabilities
vendor_ubuntu·2010-10-20·CVSS 9.3
CVE-2010-3176 [CRITICAL] Firefox and Xulrunner vulnerabilities
Title: Firefox and Xulrunner vulnerabilities
Summary: Firefox could be made to run programs as your login if it opened a
specially crafted file.
Paul Nickerson, Jesse Ruderman, Olli Pettay, Igor Bukanov, Josh Soref, Gary
Kwong, Martijn Wargers, Siddharth Agarwal and Michal Zalewski discovered
various flaws in the browser engine. An attacker could exploit this to
crash the browser or possibly run arbitrary code as the user invoking the
program. (CVE-2010-3175, CVE-2010-3176)
Alexander Miller, Sergey Glazunov, and others discovered several flaws in
the JavaScript engine. An attacker could exploit this to crash the browser
or possibly run arbitrary code as the user invoking the program.
(CVE-2010-3179, CVE-2010-3180, CVE-2010-3183)
Robert Swiecki discovered that Firefox did not properly v
Red Hat
Mozilla unsafe library loading flaw
vendor_redhat·2010-10-19·CVSS 6.9
CVE-2010-3182 [MEDIUM] Mozilla unsafe library loading flaw
Mozilla unsafe library loading flaw
A certain application-launch script in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 on Linux places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
GHSA
GHSA-j62p-q592-cjfv: A certain application-launch script in Mozilla Firefox before 3
ghsa_unreviewed·2022-05-17
CVE-2010-3182 [MEDIUM] GHSA-j62p-q592-cjfv: A certain application-launch script in Mozilla Firefox before 3
A certain application-launch script in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 on Linux places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
No detection rules found.
No public exploits indexed.
http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefoxhttp://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.htmlhttp://secunia.com/advisories/42867http://support.avaya.com/css/P8/documents/100114250http://support.avaya.com/css/P8/documents/100120156http://www.mandriva.com/security/advisories?name=MDVSA-2010:210http://www.mandriva.com/security/advisories?name=MDVSA-2010:211http://www.mozilla.org/security/announce/2010/mfsa2010-71.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0780.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0781.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0782.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0861.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0896.htmlhttp://www.securityfocus.com/bid/44251http://www.ubuntu.com/usn/USN-997-1http://www.ubuntu.com/usn/USN-998-1http://www.vupen.com/english/advisories/2011/0061https://bugzilla.mozilla.org/show_bug.cgi?id=590753https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13844http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefoxhttp://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.htmlhttp://secunia.com/advisories/42867http://support.avaya.com/css/P8/documents/100114250http://support.avaya.com/css/P8/documents/100120156http://www.mandriva.com/security/advisories?name=MDVSA-2010:210http://www.mandriva.com/security/advisories?name=MDVSA-2010:211http://www.mozilla.org/security/announce/2010/mfsa2010-71.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0780.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0781.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0782.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0861.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0896.htmlhttp://www.securityfocus.com/bid/44251http://www.ubuntu.com/usn/USN-997-1http://www.ubuntu.com/usn/USN-998-1http://www.vupen.com/english/advisories/2011/0061https://bugzilla.mozilla.org/show_bug.cgi?id=590753https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13844
2010-10-21
Published