CVE-2014-8639: Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2....

Security readout for executives and security teams

Older Mozilla clients could accept a session cookie from an HTTP proxy authentication response. A malicious or compromised proxy could force a predictable session state for a site, enabling session fixation against users of affected legacy Firefox, Thunderbird, or SeaMonkey versions. Exposure is mainly legacy desktop environments still running affected Mozilla versions, especially where browser or mail traffic uses HTTP proxies. Modern supported installations are likely already patched, but old enterprise images, offline systems, and unmanaged endpoints merit checking. Treat this as a legacy hygiene issue unless affected clients remain in use behind HTTP proxies. Prioritize remediation for managed fleets, regulated environments, and systems that still rely on old browser or mail-client builds. Mitigation focus: Upgrade Firefox to 35.0 or later, and ESR to 31.4 or later.; Upgrade Thunderbird to 31.4 or later and SeaMonkey to 2.32 or later.; Use supported vendor packages from Red Hat, Ubuntu, Debian, SUSE, Oracle, or Gentoo channels..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.