NetSight
IP …
medium6.8

CVE-2014-8639

Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers with…

Impact

Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.

Affected products

VendorProductAffected versions
MozillaSeamonkey
through 2.31
MozillaFirefox
through 34.0.5
Versions 31.0, 31.1.0, 31.1.1, 31.3.0
MozillaFirefox Esr
Version 31.2
MozillaThunderbird
through 31.3.0

References