{"id":"CVE-2010-3774","aliases":["EUVD-2010-3753","GHSA-g9p5-q9ww-v8w9","RHSA-2010:0966"],"status":"published","title":"The NS_SecurityCompareURIs function in netwerk/base/public/nsNetUtil.h in Mozilla Firefox before...","description":"The NS_SecurityCompareURIs function in netwerk/base/public/nsNetUtil.h in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle (1) about:neterror and (2) about:certerror pages, which allows remote attackers to spoof the location bar via a crafted web site.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01635,"percentile":0.76474,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2010-12-10T18:00:00Z","modified":"2026-06-28T10:04:18Z","affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-3.el4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-3.el4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-3.el4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-3.el4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-3.el4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-3.el4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-3.el4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-3.el4"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el5"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.13-3.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el6_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.13-2.el6_0"}]}],"bundled":11}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"seamonkey"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052022.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:251","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://support.avaya.com/css/P8/documents/100124650","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0966.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-1019-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://secunia.com/advisories/42818","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.securitytracker.com/id?1024850","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=602780","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12512","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052504.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2011/0030","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://www.mozilla.org/security/announce/2010/mfsa2010-83.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052502.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://secunia.com/advisories/42716","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052032.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3774","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g9p5-q9ww-v8w9"},{"url":"https://access.redhat.com/errata/RHSA-2010:0966","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.13","tags":["article"]},{"url":"http://code.google.com/p/ots/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660419","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660438","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=660439","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0966.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3766","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3766","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3767","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3767","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3768","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3770","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3770","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3771","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3771","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3772","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3773","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3773","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3774","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3775","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3775","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3776","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3776","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3777","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2010-3774","description":"The NS_SecurityCompareURIs function in netwerk/base/public/nsNetUtil.h in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle (1) about:neterror and (2) about:certerror pages, which allows remote attackers to spoof the location bar via a crafted web site.","status":"published","published":"2010-12-10T18:00:00Z","modified":"2024-08-07T03:18:53.197Z","updated_at":"2026-11-02T14:33:27.739358Z"}],"euvd":[{"id":"EUVD-2010-3753","description":"The NS_SecurityCompareURIs function in netwerk/base/public/nsNetUtil.h in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle (1) about:neterror and (2) about:certerror pages, which allows remote attackers to spoof the location bar via a crafted web site.","status":"published","published":"2010-12-10T18:00:00Z","modified":"2024-08-07T03:18:53Z","updated_at":"2026-11-03T01:39:33.066036Z"}],"ghsa":[{"id":"GHSA-g9p5-q9ww-v8w9","title":"The NS_SecurityCompareURIs function in netwerk/base/public/nsNetUtil.h in Mozilla Firefox before...","description":"The NS_SecurityCompareURIs function in netwerk/base/public/nsNetUtil.h in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle (1) about:neterror and (2) about:certerror pages, which allows remote attackers to spoof the location bar via a crafted web site.","status":"published","published":"2022-05-17T01:03:53Z","modified":"2023-02-03T05:03:07Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:53:18.133628Z"}],"nvd":[{"id":"CVE-2010-3774","description":"The NS_SecurityCompareURIs function in netwerk/base/public/nsNetUtil.h in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly handle (1) about:neterror and (2) about:certerror pages, which allows remote attackers to spoof the location bar via a crafted web site.","status":"published","published":"2010-12-10T19:00:02.627Z","modified":"2026-06-16T23:23:30.403Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:00.37682Z"}],"osv":[{"id":"RHSA-2010:0966","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-13T06:02:07Z","modified":"2026-06-28T10:04:18Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}