Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.
The Secure attribute for sensitive cookies in HTTPS sessions is not set.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Firefox | Mozilla | * | 140.1 (excluding) |
| Firefox | Mozilla | * | 141.0 (excluding) |
| Thunderbird | Mozilla | * | 140.1 (excluding) |
| Thunderbird | Mozilla | * | 141.0 (excluding) |
| Mozjs102 | Ubuntu | esm-apps/noble | * |
| Mozjs102 | Ubuntu | jammy | * |
| Mozjs102 | Ubuntu | noble | * |
| Mozjs115 | Ubuntu | devel | * |
| Mozjs115 | Ubuntu | noble | * |
| Mozjs115 | Ubuntu | plucky | * |
| Mozjs115 | Ubuntu | questing | * |
| Mozjs52 | Ubuntu | esm-apps/focal | * |
| Mozjs52 | Ubuntu | esm-infra/bionic | * |
| Mozjs68 | Ubuntu | esm-infra/focal | * |
| Mozjs78 | Ubuntu | esm-apps/jammy | * |
| Mozjs78 | Ubuntu | jammy | * |
| Mozjs91 | Ubuntu | jammy | * |
| Thunderbird | Ubuntu | upstream | * |