CVEvulnerability
CVE-2023-4055
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-08-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-120
Description
When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
Affected configurations
• mozilla firefox (< 116.0)
• mozilla firefox (>= 102.0 < 102.14)
• mozilla firefox (>= 115.0 < 115.1)
• debian debian linux 11.0
• debian debian linux 12.0
Related
Weakness · CWE (1)
- CWE-120 Buffer Copy without Checking Size of Input weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1782561 Issue Tracking, Permissions Required
- https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html lists.debian.org
- https://www.debian.org/security/2023/dsa-5464 Third Party Advisory
- https://www.debian.org/security/2023/dsa-5469 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-29/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-30/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-31/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1782561 Issue Tracking, Permissions Required
- https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html lists.debian.org
- https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html lists.debian.org
- https://www.debian.org/security/2023/dsa-5464 Third Party Advisory
- https://www.debian.org/security/2023/dsa-5469 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-29/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-30/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-31/ Vendor Advisory