Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.
Weakness
The Secure attribute for sensitive cookies in HTTPS sessions is not set.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Firefox | Mozilla | * | 140.1 (excluding) |
| Firefox | Mozilla | * | 141.0 (excluding) |
| Thunderbird | Mozilla | * | 140.1 (excluding) |
| Thunderbird | Mozilla | * | 141.0 (excluding) |
| Mozjs102 | Ubuntu | esm-apps/noble | * |
| Mozjs102 | Ubuntu | jammy | * |
| Mozjs102 | Ubuntu | noble | * |
| Mozjs115 | Ubuntu | noble | * |
| Mozjs115 | Ubuntu | plucky | * |
| Mozjs52 | Ubuntu | esm-apps/focal | * |
| Mozjs52 | Ubuntu | esm-infra/bionic | * |
| Mozjs68 | Ubuntu | esm-infra/focal | * |
| Mozjs78 | Ubuntu | esm-apps/jammy | * |
| Mozjs78 | Ubuntu | jammy | * |
| Mozjs91 | Ubuntu | jammy | * |
| Thunderbird | Ubuntu | upstream | * |