Description
Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to capture keystrokes entered on a web page, even when JavaScript is disabled, by using SVG animation accessKey events within that web page.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 | openSUSE-SU-2024:10230-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 3
- openSUSE-SU-2024:10230-1 MozillaThunderbird-45.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- MDVSA-2011:192 vendor-advisory
- 47334 third-party-advisory
- 1026447 vdb-entry
- 1026446 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=704482
- 49055 third-party-advisory
- 1026445 vdb-entry
- http://www.mozilla.org/security/announce/2011/mfsa2011-56.html
- firefox-svg-animation-info-disc(71911) vdb-entry
- oval:org.mitre.oval:def:14739 vdb-entry signature
- 47302 third-party-advisory
- 77954 vdb-entry
- openSUSE-SU-2012:0039 vendor-advisory
- openSUSE-SU-2012:0007 vendor-advisory