CVE-2008-0591

Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by using a timer to change the window focus, aka the "dialog refocus bug" or "ffclick2".

🔗 References (122)

• secalert@redhathttp://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html
• secalert@redhathttp://browser.netscape.com/releasenotes/
• secalert@redhathttp://lcamtuf.coredump.cx/ffclick2/
• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html
• secalert@redhathttp://secunia.com/advisories/28754
• secalert@redhathttp://secunia.com/advisories/28758
• secalert@redhathttp://secunia.com/advisories/28766
• secalert@redhathttp://secunia.com/advisories/28808
• secalert@redhathttp://secunia.com/advisories/28818
• secalert@redhathttp://secunia.com/advisories/28839
• secalert@redhathttp://secunia.com/advisories/28864
• secalert@redhathttp://secunia.com/advisories/28865
• secalert@redhathttp://secunia.com/advisories/28877
• secalert@redhathttp://secunia.com/advisories/28879
• secalert@redhathttp://secunia.com/advisories/28924