Description
The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated by changing focus from a textarea to a file upload field.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.11~pre071022-0etch1+lenny1 | DTSA-80-1 |
| Debian 5.0 | xulrunner | 1.8.0.14~pre071019b-0lenny1 | DTSA-69-1 |
| Debian 4.0 | iceape | 1.0.11~pre071022-0etch1 | DSA-1401-1 |
| Debian 4.0 | iceweasel | 2.0.0.6+2.0.0.8-0etch1 | DSA-1396-1 |
| Debian 4.0 | xulrunner | 1.8.0.14~pre071019b-0etch1 | DSA-1392-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-6.el5 | RHSA-2007:0979 |
| RHEL 5 | thunderbird | 1.5.0.12-5.el5 | RHSA-2007:0981 |
| RHEL 4 | firefox | 1.5.0.12-0.7.el4 | RHSA-2007:0979 |
| RHEL 4 | seamonkey +5 | 1.0.9-6.el4 | RHSA-2007:0980 |
| RHEL 4 | thunderbird | 1.5.0.12-0.5.el4 | RHSA-2007:0981 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.5.el3 | RHSA-2007:0980 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.6.el2 | RHSA-2007:0980 |
Advisories 8
- RHSA-2007:0981 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0980 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0979 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-80-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-69-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1401-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1392-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1396-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
References
- 24725 vdb-entry
- FEDORA-2007-2601 vendor-advisory
- 20071026 rPSA-2007-0225-1 firefox mailing-list
- ADV-2007-3587 vdb-entry
- 27414 third-party-advisory
- 20071029 FLEA-2007-0062-1 firefox mailing-list
- https://issues.rpath.com/browse/RPL-1858
- firefox-focus-security-bypass(35299) vdb-entry
- HPSBUX02153 vendor-advisory
- 27298 third-party-advisory
- 1018837 vdb-entry
- 27327 third-party-advisory
- ADV-2007-3544 vdb-entry
- 27276 third-party-advisory
- USN-535-1 vendor-advisory
- DSA-1401 vendor-advisory
- DSA-1392 vendor-advisory
- RHSA-2007:0980 vendor-advisory
- 27383 third-party-advisory
- SUSE-SA:2007:057 vendor-advisory
- 27356 third-party-advisory
- RHSA-2007:0981 vendor-advisory
- 37994 vdb-entry
- ADV-2008-0083 vdb-entry
- 27387 third-party-advisory
- http://sla.ckers.org/forum/read.php?3%2C13142
- FEDORA-2007-3431 vendor-advisory
- 27403 third-party-advisory
- 27336 third-party-advisory
- DSA-1396 vendor-advisory
- 27425 third-party-advisory
- 20070630 New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities mailing-list
- http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
- oval:org.mitre.oval:def:9763 vdb-entry signature
- 27325 third-party-advisory
- MDKSA-2007:202 vendor-advisory
- RHSA-2007:0979 vendor-advisory
- 27335 third-party-advisory
- 25904 third-party-advisory
- FEDORA-2007-2664 vendor-advisory
- 27480 third-party-advisory
- http://yathong.googlepages.com/FirefoxFocusBug.html
- 27680 third-party-advisory
- 20070630 Re: New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities mailing-list
- http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html
- 201516 vendor-advisory
- 20071029 rPSA-2007-0225-2 firefox thunderbird mailing-list
- USN-536-1 vendor-advisory