When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
| Link | Tags |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1782561 | issue tracking permissions required |
| https://www.mozilla.org/security/advisories/mfsa2023-29/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2023-30/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2023-31/ | vendor advisory |
| https://www.debian.org/security/2023/dsa-5464 | third party advisory |
| https://www.debian.org/security/2023/dsa-5469 | third party advisory |
| https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html | |
| https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html |