CVE-2011-3663

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-12-21 · updated 2026-06-16
Weakness: CWE-200

Description

Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to capture keystrokes entered on a web page, even when JavaScript is disabled, by using SVG animation accessKey events within that web page.

Affected products

Mozilla Firefox: 4.0, 4.0-beta1, 4.0-beta10, 4.0-beta11, 4.0-beta12, 4.0-beta2 (+15)
Mozilla Seamonkey: through 2.5; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+82)
Mozilla Thunderbird: 5.0, 6.0, 6.0.1, 6.0.2, 7.0, 7.0.1

References

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html
http://osvdb.org/77954
http://secunia.com/advisories/47302
http://secunia.com/advisories/47334
http://secunia.com/advisories/49055
http://www.mandriva.com/security/advisories?name=MDVSA-2011:192
http://www.mozilla.org/security/announce/2011/mfsa2011-56.html
http://www.securitytracker.com/id?1026445
http://www.securitytracker.com/id?1026446
http://www.securitytracker.com/id?1026447
https://bugzilla.mozilla.org/show_bug.cgi?id=704482

Get alerted when CVE-2011-3663 or the next vulnerability affects your stack