CVE-2014-8639

Publication date 14 January 2015

Last updated 24 July 2024

Ubuntu priority

Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
firefox	14.10 utopic	Fixed 35.0+build3-0ubuntu0.14.10.2
	14.04 LTS trusty	Fixed 35.0+build3-0ubuntu0.14.04.2
	12.04 LTS precise	Fixed 35.0+build3-0ubuntu0.12.04.2
	10.04 LTS lucid	Ignored end of life
thunderbird	14.10 utopic	Fixed 1:31.4.0+build1-0ubuntu0.14.10.1
	14.04 LTS trusty	Fixed 1:31.4.0+build1-0ubuntu0.14.04.1
	12.04 LTS precise	Fixed 1:31.4.0+build1-0ubuntu0.12.04.1
	10.04 LTS lucid	Ignored end of life

CVE-2014-8639

Status

References

Related Ubuntu Security Notices (USN)

Other references