What’s Vulnerable › Vulnerabilities

CVE-2010-1210

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2010-07-30 · updated 2026-06-16
• Weakness: CWE-20

Description

intl/uconv/util/nsUnicodeDecodeHelper.cpp in Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1 inserts a U+FFFD sequence into text in certain circumstances involving undefined positions, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted 8-bit text.

Affected products

• Mozilla Firefox: through 3.6.6; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+111)
• Mozilla Thunderbird: through 3.1; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+66)

References

• http://www.mozilla.org/security/announce/2010/mfsa2010-44.html
• https://bugzilla.mozilla.org/show_bug.cgi?id=564679
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11863
• http://www.mozilla.org/security/announce/2010/mfsa2010-44.html
• https://bugzilla.mozilla.org/show_bug.cgi?id=564679
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11863

Get alerted when CVE-2010-1210 or the next vulnerability affects your stack