Frédéric Buclin

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 22.0 **Description** The issue allows remote attackers to conduct clickjacking attacks via a crafted web site that uses the HTTP server push feature with multipart responses, due to the improper enforcement of the X-Frame-Options protection mechanism. **Recommendations** For versions prior to 22.0, update to version 22.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 3.x through 3.6.11 Bugzilla versions 3.7.x Bugzilla versions 4.0.x through 4.0.8 Bugzilla versions 4.1.x Bugzilla versions 4.2.x through 4.2.3 Bugzilla versions 4.3.x through 4.4rc1 **Description** The issue allows remote attackers to obtain sensitive information by reading HTML source code, specifically in circumstances involving custom-field visibility control. This occurs because the `template/en/default/bug/field-events.js.tmpl` file generates JavaScript function calls containing private product names or private component names. **Recommendations** For Bugzilla versions 3.x through 3.6.11, update to version 3.6.12 or later. For Bugzilla versions 3.7.x, update to version 4.0.9 or later. For Bugzilla versions 4.0.x through 4.0.8, update to version 4.0.9 or later. For Bugzilla versions 4.1.x, update to version 4.2.4 or later. For Bugzilla versions 4.2.x through 4.2.3, update to version 4.2.4 or later. For Bugzilla versions 4.3.x through 4.4rc1, update to version 4.4rc1 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 3.7.x through 4.0.8 Bugzilla versions 4.1.x through 4.2.3 Bugzilla versions 4.3.x through 4.4rc1 **Description** The issue concerns the User.get method in Bugzilla, where the outcome of a groups request differs based on the existence of a group. This discrepancy allows remote authenticated users to determine private group names by observing whether a call results in an error. **Recommendations** For Bugzilla versions 3.7.x through 4.0.8, update to version 4.0.9 or later. For Bugzilla versions 4.1.x through 4.2.3, update to version 4.2.4 or later. For Bugzilla versions 4.3.x through 4.4rc1, update to version 4.4 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.x through 3.x before 3.6.12 Bugzilla versions 3.7.x Bugzilla versions 4.0.x before 4.0.9 Bugzilla versions 4.1.x Bugzilla versions 4.2.x before 4.2.4 Bugzilla versions 4.3.x and 4.4.x before 4.4rc1 **Description** The issue allows remote attackers to read attachment descriptions from private bugs. This is achieved via an obsolete=1 insert action in the attachment.cgi script. **Recommendations** For versions 2.x through 3.x before 3.6.12, update to version 3.6.12 or later. For versions 3.7.x, update to a version after 3.7.x. For versions 4.0.x before 4.0.9, update to version 4.0.9 or later. For versions 4.1.x, update to a version after 4.1.x. For versions 4.2.x before 4.2.4, update to version 4.2.4 or later. For versions 4.3.x and 4.4.x before 4.4rc1, update to version 4.4rc1 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.x through 3.6.10 Bugzilla versions 3.7.x through 4.0.7 Bugzilla versions 4.1.x through 4.2.2 Bugzilla versions 4.3.x through 4.3.2 **Description** The issue allows remote attackers to potentially inject data into an LDAP directory via a crafted login attempt due to the lack of character restriction in usernames. **Recommendations** For versions 2.x through 3.6.10, update to version 3.6.11 or later. For versions 3.7.x through 4.0.7, update to version 4.0.8 or later. For versions 4.1.x through 4.2.2, update to version 4.2.3 or later. For versions 4.3.x through 4.3.2, update to version 4.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.x through 4.3.x before 4.3.3, specifically: Bugzilla versions 2.x through 3.6.11 Bugzilla versions 3.7.x Bugzilla versions 4.0.x before 4.0.8 Bugzilla versions 4.1.x Bugzilla versions 4.2.x before 4.2.3 **Description** The issue allows remote attackers to read sensitive files due to insufficient access control. This includes (1) template files, (2) custom extension files under the `extensions/` directory, or (3) custom documentation files under the `docs/` directory via a direct request. **Recommendations** For Bugzilla versions 2.x through 3.6.11, update to version 3.6.12 or later. For Bugzilla versions 3.7.x, update to version 4.0.8 or later. For Bugzilla versions 4.0.x before 4.0.8, update to version 4.0.8 or later. For Bugzilla versions 4.1.x, update to version 4.2.3 or later. For Bugzilla versions 4.2.x before 4.2.3, update to version 4.2.3 or later. For Bugzilla versions 4.3.x before 4.3.3, update to version 4.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.x through 3.6.9 Bugzilla versions 3.7.x Bugzilla versions 4.0.x through 4.0.6 Bugzilla versions 4.1.x through 4.2.1 Bugzilla versions 4.3.x through 4.3.1 **Description** The issue concerns the `get attachment link` function in `Template.pm`, which fails to check if an attachment is private before displaying its description in a public comment. This allows remote attackers to obtain sensitive information by reading a comment. **Recommendations** For Bugzilla versions 2.x through 3.6.9, update to version 3.6.10 or later. For Bugzilla versions 3.7.x, update to a version outside of the 3.7.x range, such as 4.0.7 or later. For Bugzilla versions 4.0.x through 4.0.6, update to version 4.0.7 or later. For Bugzilla versions 4.1.x through 4.2.1, update to version 4.2.2 or later. For Bugzilla versions 4.3.x through 4.3.1, update to version 4.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 4.1.x through 4.2.1 Bugzilla versions 4.3.x before 4.3.2 **Description** The issue allows remote attackers to obtain sensitive description information by reading the tooltip portions of an HTML e-mail message. This occurs because Bugzilla uses bug-editor privileges instead of bugmail-recipient privileges during the construction of HTML bugmail documents. **Recommendations** For Bugzilla versions 4.1.x through 4.2.1, update to version 4.2.2 or later. For Bugzilla versions 4.3.x before 4.3.2, update to version 4.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 4.x through 13.0 Firefox ESR versions 10.x before 10.0.6 Thunderbird versions 5.0 through 13.0 Thunderbird ESR versions 10.x before 10.0.6 SeaMonkey versions prior to 2.11 **Description** The issue arises from the improper handling of duplicate values in X-Frame-Options headers, making it easier for remote attackers to conduct clickjacking attacks via a FRAME element referencing a web site that produces these duplicate values. **Recommendations** For Mozilla Firefox versions 4.x through 13.0, update to a version after 13.0. For Firefox ESR versions 10.x before 10.0.6, update to version 10.0.6 or later. For Thunderbird versions 5.0 through 13.0, update to a version after 13.0. For Thunderbird ESR versions 10.x before 10.0.6, update to version 10.0.6 or later. For SeaMonkey versions prior to 2.11, update to version 2.11 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.x through 3.4.12 Bugzilla versions 3.5.x through 3.6.6 Bugzilla versions 3.7.x through 4.0.2 Bugzilla versions 4.1.x through 4.1.3 **Description** The issue arises from the User.offer account by email WebService method, which does not properly handle user can create account settings when createemailregexp is not empty. This allows remote attackers to create user accounts by leveraging a token contained in an e-mail message. **Recommendations** For Bugzilla versions 2.x through 3.4.12, update to version 3.4.13 or later. For Bugzilla versions 3.5.x through 3.6.6, update to version 3.6.7 or later. For Bugzilla versions 3.7.x through 4.0.2, update to version 4.0.3 or later. For Bugzilla versions 4.1.x through 4.1.3, update to a version later than 4.1.3.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.20.x through 2.20.4 Bugzilla versions 2.22.x through 2.22.2 Bugzilla versions 3.0.x through 3.0.2 **Description** The issue allows local users to obtain sensitive information by reading temporary files associated with uploaded attachments, which are not deleted. **Recommendations** For versions 2.20.x through 2.20.4, update to version 2.20.5 or later. For versions 2.22.x through 2.22.2, update to version 2.22.3 or later. For versions 3.0.x through 3.0.2, update to version 3.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.22.7 through 2.23.3 Bugzilla versions 3.0.x through 3.3.x Bugzilla versions 3.4.x before 3.4.12 Bugzilla versions 3.5.x Bugzilla versions 3.6.x before 3.6.6 Bugzilla versions 3.7.x Bugzilla versions 4.0.x before 4.0.2 Bugzilla versions 4.1.x before 4.1.3 **Description** The issue allows remote attackers to determine the existence of private group names via a crafted parameter during bug creation or bug editing. **Recommendations** For versions 2.22.7 through 2.23.3, update to a version outside of this range to resolve the issue. For versions 3.0.x through 3.3.x, update to a version outside of this range to resolve the issue. For versions 3.4.x before 3.4.12, update to version 3.4.12 or later to resolve the issue. For versions 3.5.x, update to a version outside of this range to resolve the issue. For versions 3.6.x before 3.6.6, update to version 3.6.6 or later to resolve the issue. For versions 3.7.x, update to a version outside of this range to resolve the issue. For versions 4.0.x before 4.0.2, update to version 4.0.2 or later to resolve the issue. For versions 4.1.x before 4.1.3, update to version 4.1.3 or later to resolve the issue.

CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the query string, a different vulnerability than CVE-2010-2761 and CVE-2010-4411.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.19.1 through 3.2.7 Bugzilla versions 3.3.1 through 3.4.7 Bugzilla versions 3.5.1 through 3.6.1 Bugzilla versions 3.7 through 3.7.2 **Description** The issue allows remote attackers to determine the group memberships of arbitrary users via vectors involving the Search interface, boolean charts, and group-based pronouns. **Recommendations** For Bugzilla versions 2.19.1 through 3.2.7, update to a version outside of this range to resolve the issue. For Bugzilla versions 3.3.1 through 3.4.7, update to a version outside of this range to resolve the issue. For Bugzilla versions 3.5.1 through 3.6.1, update to a version outside of this range to resolve the issue. For Bugzilla versions 3.7 through 3.7.2, update to a version outside of this range to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.17.1 through 3.2.7 Bugzilla versions 3.3.1 through 3.4.7 Bugzilla versions 3.5.1 through 3.6.1 Bugzilla versions 3.7 through 3.7.2 **Description** The issue allows remote attackers to guess product names via unspecified use of the (1) Reports or (2) Duplicates page, due to different error messages being generated depending on whether a product exists. **Recommendations** For versions 2.17.1 through 3.2.7, update to a version outside of this range to resolve the issue. For versions 3.3.1 through 3.4.7, update to a version outside of this range to resolve the issue. For versions 3.5.1 through 3.6.1, update to a version outside of this range to resolve the issue. For versions 3.7 through 3.7.2, update to a version outside of this range to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 3.0.11 and earlier, 3.2.x through 3.2.5, 3.4.x through 3.4.4, 3.5.x through 3.5.2 **Description** The issue allows remote attackers to obtain sensitive information by requesting specific files and directories used by custom installations, including (1) `CVS/`, (2) `contrib/`, (3) `docs/en/xml/`, (4) `t/`, or (5) `old-params.txt`. **Recommendations** For Bugzilla versions 3.0.11 and earlier, update to version 3.0.11 or later. For Bugzilla versions 3.2.x through 3.2.5, update to version 3.2.6 or later. For Bugzilla versions 3.4.x through 3.4.4, update to version 3.4.5 or later. For Bugzilla versions 3.5.x through 3.5.2, update to version 3.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 3.3.1 through 3.4.4 Bugzilla version 3.5.1 Bugzilla version 3.5.2 **Description** The issue allows remote attackers to obtain sensitive information via a request for a bug in certain circumstances, due to the failure to preserve group restrictions when moving a bug to a different product category. **Recommendations** For Bugzilla versions 3.3.1 through 3.4.4, update the bug moving process to preserve group restrictions. For Bugzilla version 3.5.1, modify the bug moving functionality to maintain group restrictions. For Bugzilla version 3.5.2, adjust the product category change process to retain group restrictions.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.22 through 2.22.6 Bugzilla versions 3.0 through 3.0.6 Bugzilla versions 3.2 through 3.2.0 Bugzilla versions 3.3 through 3.3.1 **Description** A cross-site request forgery issue allows remote attackers to delete keywords and user preferences via a link or IMG tag to (1) "editkeywords.cgi" or (2) "userprefs.cgi". **Recommendations** For Bugzilla versions 2.22 through 2.22.6, update to version 2.22.7. For Bugzilla versions 3.0 through 3.0.6, update to version 3.0.7. For Bugzilla versions 3.2 through 3.2.0, update to version 3.2.1. For Bugzilla versions 3.3 through 3.3.1, update to version 3.3.2.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.23.4, 3.0.x through 3.0.3, 3.1.x through 3.1.3 **Description** The issue allows remote authenticated users to more easily spoof the changer of a bug via a `@reporter` command in the body of an e-mail message. This occurs because the `@reporter` command overrides the e-mail address as normally obtained from the `From` e-mail header. Note that since `From` headers are easily spoofed, this only crosses privilege boundaries in environments that provide additional verification of e-mail addresses. **Recommendations** For Bugzilla version 2.23.4, update to a version later than 2.23.4 to resolve the issue. For Bugzilla versions 3.0.x through 3.0.3, update to version 3.0.4 or later. For Bugzilla versions 3.1.x through 3.1.3, update to version 3.1.4 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.18.x through 2.18.5 Bugzilla versions 2.20.x through 2.20.2 Bugzilla versions 2.22.x through 2.22.0 Bugzilla versions 2.23.x through 2.23.2 **Description** The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via page headers using the H1, H2, and H3 HTML tags in global/header.html.tmpl, description fields of certain items in various edit cgi scripts, and the `id` parameter in "showdependencygraph.cgi". **Recommendations** For Bugzilla versions 2.18.x through 2.18.5, update to version 2.18.6 or later. For Bugzilla versions 2.20.x through 2.20.2, update to version 2.20.3 or later. For Bugzilla versions 2.22.x through 2.22.0, update to version 2.22.1 or later. For Bugzilla versions 2.23.x through 2.23.2, update to version 2.23.3 or later.