PT-2006-1958 · Mozilla · Bugzilla

Phil Ringnalda + 1 · Publicado 2006-02-28 · Atualizado 2011-03-08 · CVE-2006-0915

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla version 2.16.10

Description The issue arises from improper handling of certain characters in the maxpatchsize and maxattachmentsize parameters in the attachment.cgi script, allowing remote attackers to trigger a SQL error.

Recommendations For Bugzilla version 2.16.10, consider restricting access to the attachment.cgi script until a proper fix is applied, and avoid using the maxpatchsize and maxattachmentsize parameters in a way that could trigger SQL errors.

Correção

Identificadores relacionados

CVE-2006-0915

Produtos afetados

Bugzilla

Referências · 4

• http://vupen.com/english/advisories/2006/0692 · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=313441 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0915 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0915 · Nota