PT-2003-1739 · Mozilla · Bugzilla

Jouni Heikniemi · Published 2003-07-29 · Updated 2008-09-05 · CVE-2003-0602

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Bugzilla versions 2.16.x through 2.16.2 Bugzilla versions 2.17.x through 2.17.3

Description: The issue allows remote attackers to insert arbitrary HTML or web script via multiple default German and Russian HTML templates or ALT and NAME attributes in AREA tags as used by the GraphViz graph generation feature for local dependency graphs.

Recommendations: For Bugzilla versions 2.16.x through 2.16.2, update to version 2.16.3 or later. For Bugzilla versions 2.17.x through 2.17.3, update to version 2.17.4 or later.

Fix

Related Identifiers

CVE-2003-0602

Affected Products

Bugzilla

References · 6

• http://securityfocus.com/bid/6868 · Vendor Advisory
• http://securityfocus.com/bid/6861 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0602 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0602 · Note
• http://bugzilla.org/security/2.16.2 · Note