PT-2010-4046 · Mozilla · Bugzilla

Max Kanat-Alexander · Publicado 2010-06-28 · Atualizado 2010-06-29 · CVE-2010-2470

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugzilla versions 3.5.1 through 3.6.1 Bugzilla versions 3.7 through 3.7.1

Description The issue allows local users to obtain potentially sensitive data by reading files in certain directories. This occurs when the use suexec option is enabled. The affected directories include .bzr and data/webdot, which have world-readable permissions.

Recommendations For Bugzilla versions 3.5.1 through 3.6.1, consider changing the permissions of the .bzr and data/webdot directories to prevent world-readable access. For Bugzilla versions 3.7 through 3.7.1, consider changing the permissions of the .bzr and data/webdot directories to prevent world-readable access.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-2470

Produtos afetados

Bugzilla

Referências · 3

• https://bugzilla.mozilla.org/show_bug.cgi?id=561797 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2010-2470 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2470 · Nota