Vulnerability in Mozilla Firefox
CVE-2014-8639
Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.
EPSS: 0.019 (77.6th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox — versions 31.0, 31.1.0, 31.1.1
- Mozilla Firefox_esr — versions 31.2
- Mozilla Seamonkey
- Mozilla Thunderbird
- N/a — versions n/a
References
- security@mozilla.org (x_refsource_REDHAT, vendor-advisory)
- security@mozilla.org (x_refsource_SECUNIA, third-party-advisory)
- security@mozilla.org (vdb-entry, x_refsource_SECTRACK)
- security@mozilla.org (x_refsource_UBUNTU, vendor-advisory)
- security@mozilla.org (vendor-advisory, x_refsource_SUSE)
- security@mozilla.org (x_refsource_SECUNIA, third-party-advisory)
- security@mozilla.org (x_refsource_CONFIRM)
- security@mozilla.org (x_refsource_SECUNIA, third-party-advisory)
- security@mozilla.org (x_refsource_SECUNIA, third-party-advisory)
- security@mozilla.org (vendor-advisory, x_refsource_SUSE)