PT-2002-2178 · Mozilla · Bugzilla

Publicado 2002-10-28 · Atualizado 2016-10-18 · CVE-2002-1196

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Bugzilla versions 2.14.x through 2.14.3 Bugzilla versions 2.16.x through 2.16.0

Description: The issue arises in the editproducts.cgi script of Bugzilla when the usebuggroups feature is enabled and more than 47 groups are specified. It fails to properly calculate bit values for large numbers due to known features of Perl math, which can set multiple bits. This miscalculation grants extra permissions to users.

Recommendations: For Bugzilla versions 2.14.x through 2.14.3, update to version 2.14.4 or later. For Bugzilla versions 2.16.x through 2.16.0, update to version 2.16.1 or later.

Correção

Identificadores relacionados

CVE-2002-1196

DSA-173

Produtos afetados

Bugzilla

Referências · 7

• http://securityfocus.com/bid/5843 · Nota
• http://debian.org/security/2002/dsa-173 · Aviso do Fabricante
• http://bugzilla.mozilla.org/show_bug.cgi?id=167485#c12 · Nota
• http://marc.info/?l=bugtraq&m=103349804226566&w=2 · Nota
• http://iss.net/security_center/static/10233.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-1196 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1196 · Nota