CVE-2008-0591
Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by…
Does this matter?
Lower severity and a low EPSS score (3.85%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by using a timer to change the window focus, aka the "dialog refocus bug" or "ffclick2".
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 3.85% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox · mozilla/thunderbird
- Source
- secalert@redhat.com
References
- http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html
- http://browser.netscape.com/releasenotes/
- http://lcamtuf.coredump.cx/ffclick2/Exploit
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html
- http://secunia.com/advisories/28754Vendor Advisory
- http://secunia.com/advisories/28758Vendor Advisory
- http://secunia.com/advisories/28766Vendor Advisory
- http://secunia.com/advisories/28808Vendor Advisory
- http://secunia.com/advisories/28818Vendor Advisory
- http://secunia.com/advisories/28839Vendor Advisory
- http://secunia.com/advisories/28864Vendor Advisory
- http://secunia.com/advisories/28865Vendor Advisory
- http://secunia.com/advisories/28877Vendor Advisory
- http://secunia.com/advisories/28879Vendor Advisory
- http://secunia.com/advisories/28924Vendor Advisory
- http://secunia.com/advisories/28939Vendor Advisory
- http://secunia.com/advisories/28958Vendor Advisory
- http://secunia.com/advisories/29049Vendor Advisory
- http://secunia.com/advisories/29086Vendor Advisory
- http://secunia.com/advisories/29164Vendor Advisory
- http://secunia.com/advisories/29167Vendor Advisory
- http://secunia.com/advisories/29567
- http://secunia.com/advisories/30327
- http://secunia.com/advisories/30620
- http://securityreason.com/securityalert/2781
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1
- http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html
- http://wiki.rpath.com/Advisories:rPSA-2008-0051
- http://wiki.rpath.com/Advisories:rPSA-2008-0093
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.