CVE-2014-8639
14.01.2015, 11:59
Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.Enginsight
| Vendor | Product | Version |
|---|---|---|
| mozilla | seamonkey | 𝑥 ≤ 2.31 |
| mozilla | firefox | 𝑥 ≤ 34.0.5 |
| mozilla | firefox | 31.0 |
| mozilla | firefox | 31.1.0 |
| mozilla | firefox | 31.1.1 |
| mozilla | firefox | 31.3.0 |
| mozilla | firefox_esr | 31.2 |
| mozilla | thunderbird | 𝑥 ≤ 31.3.0 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Ubuntu Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| firefox |
| ||||||||
| thunderbird |
|
References