CVE-2010-1199

Firefox 3.5.x-3.5.9 and 3.6.x-3.6.3 - Remote Code Execution via XSLT Node Sorting Integer Overflow

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2010-1199. PoCs published by Abysssec, Martin Barbella.

AI-analyzed exploit summary This exploit generates an XSLT stylesheet and XML file that trigger a heap overflow in Mozilla Firefox 3.6.3 due to excessive nested sorting operations, leading to remote code execution.

Description

Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a large text value for a node.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Abysssec · pythondoswindows

https://www.exploit-db.com/exploits/14949

View Code ZIP pw:eip

This exploit generates an XSLT stylesheet and XML file that trigger a heap overflow in Mozilla Firefox 3.6.3 due to excessive nested sorting operations, leading to remote code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Mozilla Firefox 3.6.3

No auth needed

Prerequisites: Victim must open the malicious XSLT and XML files in a vulnerable version of Firefox

MITRE ATT&CK

T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

exploitdb WRITEUP VERIFIED

by Martin Barbella · textremotelinux

https://www.exploit-db.com/exploits/34192

View Code ZIP pw:eip

This is a vulnerability writeup for CVE-2010-1199, describing an integer overflow vulnerability in Mozilla Firefox, SeaMonkey, and Thunderbird. The writeup references fixed versions and provides a link to a binary exploit but does not contain actual exploit code.

Classification

Writeup 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Theoretical

Target: Mozilla Firefox < 3.6.4, Firefox < 3.5.10, Thunderbird < 3.0.5, SeaMonkey < 2.0.5

No auth needed

Prerequisites: Victim must visit a malicious webpage or open a malicious file

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (32)

Core 32

Core References

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13287

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/59666

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/40481

Various Sources vendor-advisory x_refsource_ubuntu

http://ubuntu.com/usn/usn-930-1

Exploit, Third Party Advisory exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/14949

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1024138