What’s Vulnerable › Vulnerabilities

CVE-2010-0159

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2010-02-22 · updated 2026-06-16

Description

The browser engine in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, Thunderbird before 3.0.2, and SeaMonkey before 2.0.3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the nsBlockFrame::StealFrame function in layout/generic/nsBlockFrame.cpp, and unspecified other vectors.

Affected products

• Canonical Ubuntu Linux: 8.04, 8.10, 9.04, 9.10
• Debian Linux: 5.0
• Mozilla Firefox: from 3.0 before 3.0.18; from 3.5 before 3.5.8 — fixed in 3.0.18, 3.5.8
• Mozilla Seamonkey: before 2.0.3 — fixed in 2.0.3
• Mozilla Thunderbird: before 3.0.2 — fixed in 3.0.2

How to fix

Upgrade to a fixed version: Mozilla Firefox 3.0.18, 3.5.8; Mozilla Seamonkey 2.0.3; Mozilla Thunderbird 3.0.2. Check the vendor advisory for mitigations.

References

• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036097.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036132.html
• http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html
• http://secunia.com/advisories/37242
• http://secunia.com/advisories/38770
• http://secunia.com/advisories/38772
• http://secunia.com/advisories/38847
• http://www.debian.org/security/2010/dsa-1999
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:042

Get alerted when CVE-2010-0159 or the next vulnerability affects your stack