7.5

CVE-2023-4055

When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version < 116.0
Mozilla ≫ Firefox Version >= 102.0 < 102.14
Mozilla ≫ Firefox Version >= 115.0 < 115.1
Debian ≫ Debian Linux Version11.0
Debian ≫ Debian Linux Version12.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.61% 0.447
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html
https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
https://www.debian.org/security/2023/dsa-5464
Third Party Advisory
https://www.debian.org/security/2023/dsa-5469
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-29/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-30/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-31/
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1782561
Issue Tracking
Permissions Required