CVE-2007-3511

Published: Jul 3, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated by changing focus from a textarea to a file upload field.

Affected (26)

Products: Mozilla: Firefox, Seamonkey

Mozilla

2 products

Firefox

Seamonkey

Configuration A

26 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 2.0.0.7
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Seamonkey	Up to 1.1.4
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.99
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 alpha
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1

References (96)

http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0646.html

Source: cve@mitre.org

http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0658.html

Source: cve@mitre.org

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: cve@mitre.org

http://osvdb.org/37994

Source: cve@mitre.org

http://secunia.com/advisories/25904

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27276

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27298

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27325

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27327

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27335

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27336

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27356

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27383

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27387

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27403

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27414

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27425

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27480

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27680

Source: cve@mitre.org

Vendor Advisory

http://securitytracker.com/id?1018837

Source: cve@mitre.org

http://sla.ckers.org/forum/read.php?3%2C13142

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1

Source: cve@mitre.org

http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1392

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1396

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1401

Source: cve@mitre.org

http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202

Source: cve@mitre.org

http://www.mozilla.org/security/announce/2007/mfsa2007-32.html

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2007_57_mozilla.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0979.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0980.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0981.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/482876/100/200/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/482925/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/482932/100/200/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/24725

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-536-1

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/3544

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2007/3587

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2008/0083

Source: cve@mitre.org

Vendor Advisory

http://yathong.googlepages.com/FirefoxFocusBug.html

Source: cve@mitre.org

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/35299

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-1858

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9763

Source: cve@mitre.org

https://usn.ubuntu.com/535-1/

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00498.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00285.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00355.html

Source: cve@mitre.org

http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0646.html