Mozilla Foundation Security Advisory 2010-31

Mozilla Foundation Security Advisory 2010-31 Title: focus behavior can be used to inject or steal keystrokes Impact: Moderate Announced: June 22, 2010 Reporter: Michal Zalewski Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.4 Firefox 3.5.10 SeaMonkey 2.0.5 Description Google security research...

SeaMonkey < 2.0.5 Multiple Vulnerabilities

Binary data 800874.prm...

Firefox 3.6.x < 3.6.4 Multiple Vulnerabilities

Binary data 800742.prm...

Firefox < 3.5.10 Multiple Vulnerabilities

Binary data 800758.prm...

SeaMonkey < 2.0.5 Multiple Vulnerabilities

Binary data 5581.prm...

firefox: keystrokes sent to hidden frame rather than visible frame due to javascript flaw

The JavaScript implementation in Mozilla Firefox 3.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus metho...

mozilla -- multiple vulnerabilities

Mozilla Project reports: MFSA 2010-33 User tracking across sites using Math.random MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present MFSA 2010-31 focus behavior can be used to inject or steal keystrokes MFSA 2010-30 Integer Overflow in XSLT Node Sorting...

focus() behavior can be used to inject or steal keystrokes — Mozilla

Google security researcher Michal Zalewski reported that focus could be used to change a user's cursor focus while they are typing, potentially directing their keyboard input to an unintended location. This behavior was also present across origins when content from one domain was embedded within...