VIR Vulnerability Intelligence Relay

CVE-2014-8639

medium
Published 2015-01-14 · Modified 2026-05-06
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8

Description

Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security@mozilla.org — http://www.mozilla.org/security/announce/2014/mfsa2015-04.html

Application impact
VendorProductVersionsFixed
mozillaseamonkey{"endIncluding":"2.31"}
mozillafirefox{"endIncluding":"34.0.5"}
mozillafirefox31.0
mozillafirefox31.1.0
mozillafirefox31.1.1
mozillafirefox31.3.0
mozillafirefox_esr31.2
mozillathunderbird{"endIncluding":"31.3.0"}

References

Verify integrity in audit chain (admin only). AS-IS.