NVD

Id
35640  
Name
CVE-2014-8639  
Description
Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-01-14  
Modified Date
2017-01-02  
Seq
2014-8639  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
182513 35640 CVE-2014-8639 http://linux.oracle.com/errata/ELSA-2015-0046.html  View
182514 35640 CVE-2014-8639 http://linux.oracle.com/errata/ELSA-2015-0047.html  View
182515 35640 CVE-2014-8639 openSUSE-SU-2015:0077  View
182516 35640 CVE-2014-8639 SUSE-SU-2015:0171  View
182517 35640 CVE-2014-8639 SUSE-SU-2015:0173  View
182518 35640 CVE-2014-8639 SUSE-SU-2015:0180  View
182519 35640 CVE-2014-8639 openSUSE-SU-2015:0192  View
182520 35640 CVE-2014-8639 openSUSE-SU-2015:1266  View
182521 35640 CVE-2014-8639 openSUSE-SU-2015:0133  View
182522 35640 CVE-2014-8639 RHSA-2015:0046  View
182523 35640 CVE-2014-8639 RHSA-2015:0047  View
182524 35640 CVE-2014-8639 62253  View
182525 35640 CVE-2014-8639 62259  View
182526 35640 CVE-2014-8639 62273  View
182527 35640 CVE-2014-8639 62274  View
182528 35640 CVE-2014-8639 62283  View
182529 35640 CVE-2014-8639 62293  View
182530 35640 CVE-2014-8639 62304  View
182531 35640 CVE-2014-8639 62313  View
182532 35640 CVE-2014-8639 62315  View
182533 35640 CVE-2014-8639 62316  View
182534 35640 CVE-2014-8639 62418  View
182535 35640 CVE-2014-8639 DSA-3127  View
182536 35640 CVE-2014-8639 DSA-3132  View
182537 35640 CVE-2014-8639 http://www.mozilla.org/security/announce/2014/mfsa2015-04.html  View
182538 35640 CVE-2014-8639 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html  View
182539 35640 CVE-2014-8639 72046  View
182540 35640 CVE-2014-8639 1031533  View
182541 35640 CVE-2014-8639 1031534  View
182542 35640 CVE-2014-8639 USN-2460-1  View
182543 35640 CVE-2014-8639 firefox-cve20148639-session-hijacking(99959)  View
182544 35640 CVE-2014-8639 https://bugzilla.mozilla.org/show_bug.cgi?id=1095859  View
182545 35640 CVE-2014-8639 GLSA-201504-01  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
18714 JVNDB-2014-007589 複数の Mozilla 製品におけるセッション固定攻撃を実行される脆弱性 Mozilla Firefox、Thunderbird、および SeaMonkey は、ステータスコード 407 (別名 Proxy Authentication Required) を伴うレスポンスの中の Set-Cookie ヘッダを適切に解釈しないため、セッション固定攻撃を実行される脆弱性が存在します。 CVE-2014-8639 75932 CVE-2014-8639 35640 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007589.html 2014-11-06 2015-05-12 View