CVE-2023-4055 — Classic Buffer Overflow in Mozilla Firefox

CWE-120 — Classic Buffer OverflowCWE-784 — Reliance on Cookies without Validation and Integrity Checking in a Security Decision16 documents8 sources
Severity
7.5HIGHNVD
OSV5.3
EPSS
0.3%
top 42.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird+1 more
Timeline
PublishedAug 1
Latest updateSep 4

Description

When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5mozilla/firefoxunspecified — 116
▶NVDmozilla/firefox102.0 — 102.14+2
▶CVEListV5mozilla/firefox_esrunspecified — 102.14+1
▶Ubuntumozilla/firefox< 116.0+build2-0ubuntu0.20.04.2
▶Debianmozilla/thunderbird< 1:102.14.0-1~deb11u1+3

Also affects: Debian Linux 11.0, 12.0

🔴Vulnerability Details

6
OSV
firefox regressions↗2023-08-21
▶
OSV
firefox regressions↗2023-08-08
▶
OSV
firefox vulnerabilities↗2023-08-02
▶
GHSA
GHSA-38vw-jr6f-3c23: When the number of cookies per domain was exceeded in `document↗2023-08-01
▶
CVEList
CVE-2023-4055: When the number of cookies per domain was exceeded in `document↗2023-08-01
▶

📋Vendor Advisories

9
Ubuntu
Thunderbird vulnerabilities↗2023-09-04
▶
Ubuntu
Firefox vulnerabilities↗2023-08-02
▶
Red Hat
Mozilla: Cookie jar overflow caused unexpected cookie jar state↗2023-08-01
▶
Debian
CVE-2023-4055: firefox - When the number of cookies per domain was exceeded in `document.cookie`, the act...↗2023
▶
Mozilla
Mozilla Foundation Security Advisory 2023-31: CVE-2023-4055↗
▶
CVE-2023-4055 — Classic Buffer Overflow in Mozilla | cvebase