CVE-2014-8639 Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy A...
MediumCVSS 6.8
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla seamonkey | <= 2.31 | No fix listed |
| mozilla Firefox | <= 34.0.5 | No fix listed |
| mozilla Firefox | = 31.0 | No fix listed |
| mozilla Firefox | = 31.1.0 | No fix listed |
| mozilla Firefox | = 31.1.1 | No fix listed |
| mozilla Firefox | = 31.3.0 | No fix listed |
| mozilla firefox esr | = 31.2 | No fix listed |
| mozilla Thunderbird | <= 31.3.0 | No fix listed |
References
- linux.oracle.com
- linux.oracle.com
- openSUSE-SU-2015:0077 vendor-advisory
- SUSE-SU-2015:0171 vendor-advisory
- SUSE-SU-2015:0173 vendor-advisory
- SUSE-SU-2015:0180 vendor-advisory
- openSUSE-SU-2015:0192 vendor-advisory
- openSUSE-SU-2015:1266 vendor-advisory
- openSUSE-SU-2015:0133 vendor-advisory
- RHSA-2015:0046 vendor-advisory
- RHSA-2015:0047 vendor-advisory
- 62237 third-party-advisory
- 62242 third-party-advisory
- 62250 third-party-advisory
- 62253 third-party-advisory
- 62259 third-party-advisory
- 62273 third-party-advisory
- 62274 third-party-advisory
- 62283 third-party-advisory
- 62293 third-party-advisory
- 62304 third-party-advisory
- 62313 third-party-advisory
- 62315 third-party-advisory
- 62316 third-party-advisory
- 62418 third-party-advisory
- 62446 third-party-advisory
- 62657 third-party-advisory
- 62790 third-party-advisory
- DSA-3127 vendor-advisory
- DSA-3132 vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- 72046 vdb-entry
- 1031533 vdb-entry
- 1031534 vdb-entry
- USN-2460-1 vendor-advisory
- bugzilla.mozilla.org
- firefox-cve20148639-session-hijacking(99959) vdb-entry
- GLSA-201504-01 vendor-advisory