CVE-2023-4055

Description

When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

Reserved 2023-08-01 | Published 2023-08-01 | Updated 2024-10-22 | Assigner mozilla

Problem types

Cookie jar overflow caused unexpected cookie jar state

Product status

Any version before 116
affected

Any version before 102.14
affected

Any version before 115.1
affected

Credits

Marco Squarcina

References

bugzilla.mozilla.org/show_bug.cgi?id=1782561

www.mozilla.org/security/advisories/mfsa2023-29/

www.mozilla.org/security/advisories/mfsa2023-30/

www.mozilla.org/security/advisories/mfsa2023-31/

www.debian.org/security/2023/dsa-5464

www.debian.org/security/2023/dsa-5469

lists.debian.org/debian-lts-announce/2023/08/msg00008.html

lists.debian.org/debian-lts-announce/2023/08/msg00010.html

cve.org (CVE-2023-4055)

nvd.nist.gov (CVE-2023-4055)

Download JSON