CVE-2008-0591

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-02-09 · updated 2026-06-16

Description

Mozilla Firefox before 2.0.0.12 and Thunderbird before 2.0.0.12 does not properly manage a delay timer used in confirmation dialogs, which might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by using a timer to change the window focus, aka the "dialog refocus bug" or "ffclick2".

Affected products

Mozilla Firefox: through 2.0.0.11
Mozilla Thunderbird: through 2.0.0.11

References

http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html
http://browser.netscape.com/releasenotes/
http://lcamtuf.coredump.cx/ffclick2/
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html
http://secunia.com/advisories/28754
http://secunia.com/advisories/28758
http://secunia.com/advisories/28766
http://secunia.com/advisories/28808
http://secunia.com/advisories/28818
http://secunia.com/advisories/28839
http://secunia.com/advisories/28864
http://secunia.com/advisories/28865

Get alerted when CVE-2008-0591 or the next vulnerability affects your stack