CVE-2014-8639
CVE-2014-8639
Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.
Affected products
n/a · n/aWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://linux.oracle.com/errata/ELSA-2015-0046.htmlhttp://linux.oracle.com/errata/ELSA-2015-0047.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.htmlhttp://lists.opensuse.org/opensuse-updates/2015-01/msg00071.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0046.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0047.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=1095859