Lucene search

K
gentooGentoo FoundationGLSA-201110-03
HistoryOct 10, 2011 - 12:00 a.m.

Bugzilla: Multiple vulnerabilities

2011-10-1000:00:00
Gentoo Foundation
security.gentoo.org
18

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.032

Percentile

91.2%

Background

Bugzilla is the bug-tracking system from the Mozilla project.

Description

Multiple vulnerabilities have been discovered in Bugzilla. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could conduct cross-site scripting attacks, conduct script insertion and spoofing attacks, hijack the authentication of arbitrary users, inject arbitrary HTTP headers, obtain access to arbitrary accounts, disclose the existence of confidential groups and its names, or inject arbitrary e-mail headers.

A local attacker could disclose the contents of temporarfy files for uploaded attachments.

Workaround

There is no known workaround at this time.

Resolution

All Bugzilla users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-apps/bugzilla-3.6.6"

NOTE: This is a legacy GLSA. Updates for all affected architectures are available since August 27, 2011. It is likely that your system is already no longer affected by this issue.

OSVersionArchitecturePackageVersionFilename
Gentooanyallwww-apps/bugzilla< 3.6.6UNKNOWN

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.032

Percentile

91.2%