|
|
| |
|
| |
bugzilla: multiple vulnerabilities
| Package(s): | bugzilla |
CVE #(s): | CVE-2007-4543
CVE-2007-4538
CVE-2007-4539
|
| Created: | October 1, 2007 |
Updated: | October 3, 2007 |
| Description: |
Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not
properly sanitize the content of the "buildid" parameter when filing
bugs (CVE-2007-4543). The next two vulnerabilities only affect Bugzilla
2.23.3 or later, hence the stable Gentoo Portage tree does not contain
these two vulnerabilities: Loic Minier reported that the
"Email::Send::Sendmail()" function does not properly sanitise "from"
email information before sending it to the "-f" parameter of
/usr/sbin/sendmail (CVE-2007-4538), and Frédéric Buclin discovered
that the XML-RPC interface does not correctly check permissions in the
time-tracking fields (CVE-2007-4539).
|
| Alerts: |
|
( Log in to post comments)
|
|
|