CVE-2010-3769
The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13,...
The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 on Windows does not properly handle long strings, which allows remote attackers to execute arbitrary code via a crafted document.write call that triggers a buffer over-read.
Exploit likelihood
What each source reports
NVD Score used
The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 on Windows does not properly handle long strings, which allows remote attackers to execute arbitrary code via a crafted document.write call that triggers a buffer over-read.
- Record
CVE-2010-3769- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 on Windows does not properly handle long strings, which allows remote attackers to execute arbitrary code via a crafted document.write call that triggers a buffer over-read.
- Record
CVE-2010-3769- Updated
- 2026-11-02
EUVDEUVD-2010-3748 No score
The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 on Windows does not properly handle long strings, which allows remote attackers to execute arbitrary code via a crafted document.write call that triggers a buffer over-read.
- Record
EUVD-2010-3748- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jhhg-4257-5g55 No score
The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13,...
The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 on Windows does not properly handle long strings, which allows remote attackers to execute arbitrary code via a crafted document.write call that triggers a buffer over-read.
- Record
GHSA-jhhg-4257-5g55- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10218-1 No score
seamonkey-2.40-6.1 on GA media
These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10218-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10230-1 No score
MozillaThunderbird-45.5.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10230-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xulrunnerDebian:5.0 From an advisory covering 9 CVEs |
before 1.9.0.19-7, plus listed versions 1.9.0.10-11.9.0.11-0lenny11.9.0.11-11.9.0.12-0lenny11.9.0.12-1 Show 21 moreShow less1.9.0.13-0lenny11.9.0.13-11.9.0.14-0lenny11.9.0.14-11.9.0.15-0lenny11.9.0.16-11.9.0.18-11.9.0.19-11.9.0.19-21.9.0.19-31.9.0.19-41.9.0.19-51.9.0.19-61.9.0.5-11.9.0.6-11.9.0.7-0lenny11.9.0.7-0lenny21.9.0.7-11.9.0.8-11.9.0.9-0lenny21.9.0.9-1 |
1.9.0.19-7 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 560 CVEs |
before 45.5.1-1.1 | 45.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3769 is a high vulnerability (CVSS 9.3) in Mozilla Firefox, published December 10, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.62%, the 91st percentile. No source names a fixed version.
References
lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html
mandriva.com/security/advisories?name=MDVSA-2010:258
secunia.com/advisories/42818
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12342
securitytracker.com/id?1024846
Show 194 moreShow less
debian.org/security/2010/dsa-2132
lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html
vupen.com/english/advisories/2011/0030
securityfocus.com/bid/45345
bugzilla.mozilla.org/show_bug.cgi?id=608336
mozilla.org/security/announce/2010/mfsa2010-75.html
osvdb.org/69771
nvd.nist.gov/vuln/detail/CVE-2010-3769
github.com/advisories/GHSA-jhhg-4257-5g55
suse.com/security/cve/CVE-2008-5913
Left out here: 540 references. The JSON record has them.