This is a multi-part message in MIME format...
------------=_1365437351-2161-293
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2013:066
http://www.mandriva.com/en/support/security/
_______________________________________________________________________
Package : bugzilla
Date : April 8, 2013
Affected: Business Server 1.0
_______________________________________________________________________
Problem Description:
Multiple vulnerablilities was identified and fixed in bugzilla:
The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x
before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before
4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment
is private before presenting the attachment description within a
public comment, which allows remote attackers to obtain sensitive
description information by reading a comment (CVE-2012-1969).
Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and
4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before
4.3.3 does not restrict the characters in a username, which might
allow remote attackers to inject data into an LDAP directory via a
crafted login attempt (CVE-2012-3981).
Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and
4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote
attackers to inject arbitrary web script or HTML via a field value
that is not properly handled during construction of a tabular report,
as demonstrated by the Version field (CVE-2012-4189).
Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before
3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4,
and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to read
attachment descriptions from private bugs via an obsolete=1 insert
action (CVE-2012-4197).
The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x
and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x
and 4.4.x before 4.4rc1 has a different outcome for a groups request
depending on whether a group exists, which allows remote authenticated
users to discover private group names by observing whether a call
throws an error (CVE-2012-4198).
template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before
3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4,
and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function
calls containing private product names or private component names
in certain circumstances involving custom-field visibility control,
which allows remote attackers to obtain sensitive information by
reading HTML source code (CVE-2012-4199).
Cross-site scripting (XSS) vulnerability in the Flash component
infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x
and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and
4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web
script or HTML via vectors related to swfstore.swf, a similar issue
to CVE-2010-4209 (CVE-2012-5883).
Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla
before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before
4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to
inject arbitrary web script or HTML via the id parameter in conjunction
with an invalid value of the format parameter (CVE-2013-0785).
The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x
before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different
error messages for invalid product queries depending on whether a
product exists, which allows remote attackers to discover private
product names by using debug mode for a query (CVE-2013-0786).
The updated packages have upgraded to the 4.2.5 version which is not
vulnerable to these issues
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1969
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3981
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4189
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5883
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0785
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0786
_______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64:
a753924624b7a35c3a6dcb1f678075ab mbs1/x86_64/bugzilla-4.2.5-1.mbs1.noarch.rpm
3eccc9f3c4729038b3dd01099864a61b
mbs1/x86_64/bugzilla-contrib-4.2.5-1.mbs1.noarch.rpm
b946c6c6a6f321569d17a288faa5ab77 mbs1/SRPMS/bugzilla-4.2.5-1.mbs1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFRYsFhmqjQ0CJFipgRAhqNAJ9qMqlRDCwA0ufHhenvHOfTEbgylACgnBrd
BzUIXX1pJYjUTgpYbtZKJaY=
=AqGQ
-----END PGP SIGNATURE-----
------------=_1365437351-2161-293
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________
------------=_1365437351-2161-293--
|
