[ GLSA 201006-19 ] Bugzilla: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: Bugzilla: Multiple vulnerabilities (GLSA 201006-19)
Severity: normal
Exploitable: remote
Date: June 04, 2010
Bug(s): #239564, #258592, #264572, #284824, #303437, #303725
ID: 201006-19

Synopsis


Bugzilla is prone to multiple medium severity vulnerabilities.


Background


Bugzilla is a bug tracking system from the Mozilla project.


Affected Packages

Package: www-apps/bugzilla
Vulnerable: < 3.2.6
Unaffected: >= 3.2.6
Architectures: All supported architectures


Description


Multiple vulnerabilities have been reported in Bugzilla. Please review
the CVE identifiers referenced below for details.


Impact


A remote attacker might be able to disclose local files, bug
information, passwords, and other data under certain circumstances.
Furthermore, a remote attacker could conduct SQL injection, Cross-Site
Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks via
various vectors.


Workaround


There is no known workaround at this time.


Resolution


All Bugzilla users should upgrade to an unaffected version: