Description
The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated by changing focus from a textarea to a file upload field.
References (48)
Core 48
Core References
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00285.html
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/3587
Issue Tracking x_refsource_confirm
https://issues.rpath.com/browse/RPL-1858
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/35299
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/3544
Vendor Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/535-1/
Exploit x_refsource_misc
http://yathong.googlepages.com/FirefoxFocusBug.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/24725
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/482876/100/200/threaded
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27414
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/482925/100/0/threaded
Vendor Advisory vendor-advisory
x_refsource_hp
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27298
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1018837
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27327
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27276
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2007/dsa-1401
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2007/dsa-1392
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0980.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27383
Vendor Advisory vendor-advisory
x_refsource_suse
http://www.novell.com/linux/security/advisories/2007_57_mozilla.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27356
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0981.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/37994
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0083
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27387
Various Sources x_refsource_misc
http://sla.ckers.org/forum/read.php?3%2C13142
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00498.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27403
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27336
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2007/dsa-1396
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27425
Third Party Advisory mailing-list
x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0646.html
Various Sources x_refsource_confirm
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9763
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27325
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0979.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27335
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/25904
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00355.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27480
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27680
Third Party Advisory mailing-list
x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0658.html
Vendor Advisory x_refsource_confirm
http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html
Vendor Advisory vendor-advisory
x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/482932/100/200/threaded
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-536-1
Scores
EPSS
0.0236
EPSS Percentile
81.9%
Details
Status
published
Products (21)
mozilla/firefox
1.5.0.12
mozilla/firefox
2.0.0.4
mozilla/firefox
2.0.0.5
mozilla/firefox
2.0.0.6
mozilla/firefox
< 2.0.0.7
mozilla/seamonkey
1.0 (6 CPE variants)
mozilla/seamonkey
1.0.1
mozilla/seamonkey
1.0.2
mozilla/seamonkey
1.0.3
mozilla/seamonkey
1.0.4
... and 11 more
Published
Jul 03, 2007
Tracked Since
Feb 18, 2026