|Mozilla Firefox before 18.104.22.168 and Thunderbird before 22.214.171.124 does
not properly manage a delay timer used in confirmation dialogs, which
might allow remote attackers to trick users into confirming an unsafe
action, such as remote file execution, by using a timer to change the
window focus, aka the "dialog refocus bug" or "ffclick2".