bugzilla -- multiple serious vulnerabilities

ID C8C927E5-2891-11E0-8F26-00151735203A
Type freebsd
Reporter FreeBSD
Modified 2011-01-24T00:00:00


A Bugzilla Security Advisory reports:

This advisory covers three security issues that have recently been fixed in the Bugzilla code:

A weakness in Bugzilla could allow a user to gain unauthorized access to another Bugzilla account. A weakness in the Perl CGI.pm module allows injecting HTTP headers and content to users via several pages in Bugzilla. If you put a harmful "javascript:" or "data:" URL into Bugzilla's "URL" field, then there are multiple situations in which Bugzilla will unintentionally make that link clickable. Various pages lack protection against cross-site request forgeries.

All affected installations are encouraged to upgrade as soon as possible.