CVE-2010-0160

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-02-22 · updated 2026-06-16
Weakness: CWE-399

Description

The Web Worker functionality in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly handle array data types for posted messages, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.

Affected products

Mozilla Firefox: through 3.0.17; 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+19)
Mozilla Seamonkey: through 2.0.2; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+35)

References

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html
http://secunia.com/advisories/37242
http://secunia.com/advisories/38847
http://www.debian.org/security/2010/dsa-1999
http://www.mandriva.com/security/advisories?name=MDVSA-2010:042
http://www.mozilla.org/security/announce/2010/mfsa2010-02.html
http://www.redhat.com/support/errata/RHSA-2010-0112.html
http://www.securityfocus.com/archive/1/510533/100/0/threaded
http://www.ubuntu.com/usn/USN-895-1

Get alerted when CVE-2010-0160 or the next vulnerability affects your stack