Description
When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
Problem types
Cookie jar overflow caused unexpected cookie jar state
Product status
Credits
Marco Squarcina
References
bugzilla.mozilla.org/show_bug.cgi?id=1782561
www.mozilla.org/security/advisories/mfsa2023-29/
www.mozilla.org/security/advisories/mfsa2023-30/
www.mozilla.org/security/advisories/mfsa2023-31/
www.debian.org/security/2023/dsa-5464
www.debian.org/security/2023/dsa-5469
lists.debian.org/debian-lts-announce/2023/08/msg00008.html
lists.debian.org/debian-lts-announce/2023/08/msg00010.html
