CVE-2007-3511
The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which…
Does this matter?
Lower severity and a low EPSS score (2.36%). Track it; it rarely justifies an emergency change on its own.
Description
The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated by changing focus from a textarea to a file upload field.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.36% probability · 83th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox · mozilla/seamonkey
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0646.html
- http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0658.html
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
- http://osvdb.org/37994
- http://secunia.com/advisories/25904Vendor Advisory
- http://secunia.com/advisories/27276Vendor Advisory
- http://secunia.com/advisories/27298Vendor Advisory
- http://secunia.com/advisories/27325Vendor Advisory
- http://secunia.com/advisories/27327Vendor Advisory
- http://secunia.com/advisories/27335Vendor Advisory
- http://secunia.com/advisories/27336Vendor Advisory
- http://secunia.com/advisories/27356Vendor Advisory
- http://secunia.com/advisories/27383Vendor Advisory
- http://secunia.com/advisories/27387Vendor Advisory
- http://secunia.com/advisories/27403Vendor Advisory
- http://secunia.com/advisories/27414Vendor Advisory
- http://secunia.com/advisories/27425Vendor Advisory
- http://secunia.com/advisories/27480Vendor Advisory
- http://secunia.com/advisories/27680Vendor Advisory
- http://securitytracker.com/id?1018837
- http://sla.ckers.org/forum/read.php?3%2C13142
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
- http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html
- http://www.debian.org/security/2007/dsa-1392
- http://www.debian.org/security/2007/dsa-1396
- http://www.debian.org/security/2007/dsa-1401
- http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202
- http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
- http://www.novell.com/linux/security/advisories/2007_57_mozilla.html
- http://www.redhat.com/support/errata/RHSA-2007-0979.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.