CVE-2010-2753: Mozilla Firefox

High severity, CVSS 8.8. EPSS: 6.7% chance of exploitation in the next 30 days.

Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via a large selection attribute in a XUL tree element, which triggers a use-after-free.

Affected products

• Mozilla Firefox: from 3.5, before 3.5.11 (fixed in 3.5.11); from 3.6, before 3.6.7 (fixed in 3.6.7)
• Mozilla Seamonkey: before 2.0.6 (fixed in 2.0.6)
• Mozilla Thunderbird: from 3.0, before 3.0.6 (fixed in 3.0.6); version 3.1 only
• Opensuse Opensuse: version 11.1 only; version 11.2 only; version 11.3 only
• Suse Linux Enterprise Desktop: version 11 only
• Suse Linux Enterprise Server: version 11 only
• Suse Linux Enterprise Software Development Kit: version 11 only

Published 2010-07-30. Last modified 2026-06-16.