PT-2006-1957 · Mozilla · Bugzilla

Frédéric Buclin · Published 2006-02-28 · Updated 2018-10-18 · CVE-2006-0914

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.16.10, 2.17 through 2.18.4, and 2.20

Description The issue arises from improper handling of certain characters in the mostfreqthreshold parameter in the duplicates.cgi file, allowing remote attackers to trigger a SQL error.

Recommendations For Bugzilla versions 2.16.10, 2.17 through 2.18.4, and 2.20, avoid using the mostfreqthreshold parameter in the duplicates.cgi file until a patch is available. As a temporary workaround, consider restricting access to the duplicates.cgi file to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2006-0914

Affected Products

Bugzilla

References · 6

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=312498 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0914 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0914 · Note
• http://vupen.com/english/advisories/2006/0692 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42802 · Note
• http://securityfocus.com/archive/1/425584/100/0/threaded · Note