Description
Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by using a timer to change the window focus, aka the "dialog refocus bug" or "ffclick2".
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.redhat.com/support/errata/RHSA-2008-0104.html ↗
- http://www.ubuntu.com/usn/usn-576-1 ↗
- http://browser.netscape.com/releasenotes/ ↗
- http://secunia.com/advisories/28939 ↗
- http://www.debian.org/security/2008/dsa-1506 ↗
- https://issues.rpath.com/browse/RPL-1995 ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00946.html ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00905.html ↗
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093 ↗
- http://lcamtuf.coredump.cx/ffclick2/ ↗
- http://secunia.com/advisories/28766 ↗
- http://secunia.com/advisories/28818 ↗
- http://www.mozilla.org/security/announce/2008/mfsa2008-08.html ↗
- http://secunia.com/advisories/30620 ↗
- http://secunia.com/advisories/28865 ↗
- http://secunia.com/advisories/29049 ↗
- http://www.vupen.com/english/advisories/2008/0453/references ↗
- http://www.redhat.com/support/errata/RHSA-2008-0103.html ↗
- http://secunia.com/advisories/28877 ↗
- http://secunia.com/advisories/28879 ↗
- http://secunia.com/advisories/29167 ↗
- http://secunia.com/advisories/29567 ↗
- http://www.redhat.com/support/errata/RHSA-2008-0105.html ↗
- http://secunia.com/advisories/28958 ↗
- http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html ↗
- http://secunia.com/advisories/30327 ↗
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10900 ↗
- http://www.securityfocus.com/archive/1/488971/100/0/threaded ↗
- http://www.debian.org/security/2008/dsa-1489 ↗
- http://www.securityfocus.com/archive/1/488002/100/0/threaded ↗
- http://www.securityfocus.com/archive/1/487826/100/0/threaded ↗
- http://secunia.com/advisories/29086 ↗
- http://www.vupen.com/english/advisories/2008/0454/references ↗
- http://secunia.com/advisories/28864 ↗
- http://www.debian.org/security/2008/dsa-1485 ↗
- http://secunia.com/advisories/28924 ↗
- http://www.securityfocus.com/bid/27683 ↗
- https://bugzilla.mozilla.org/show_bug.cgi?id=376473 ↗
- http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html ↗
- http://www.vupen.com/english/advisories/2008/1793/references ↗
- http://www.securityfocus.com/archive/1/470446/100/0/threaded ↗
- http://www.securitytracker.com/id?1019339 ↗
- http://wiki.rpath.com/Advisories:rPSA-2008-0093 ↗
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html ↗
- http://www.securityfocus.com/bid/24293 ↗
- http://securityreason.com/securityalert/2781 ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00309.html ↗
- http://secunia.com/advisories/29164 ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.html ↗
- http://wiki.rpath.com/Advisories:rPSA-2008-0051 ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:062 ↗
- http://www.debian.org/security/2008/dsa-1484 ↗
- http://secunia.com/advisories/28808 ↗
- http://www.vupen.com/english/advisories/2008/0627/references ↗
- http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml ↗
- http://secunia.com/advisories/28754 ↗
- http://secunia.com/advisories/28758 ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.html ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:048 ↗
- http://secunia.com/advisories/28839 ↗