PT-2006-1958 · Mozilla · Bugzilla

Phil Ringnalda + 1 · Published 2006-02-28 · Updated 2011-03-08 · CVE-2006-0915

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bugzilla version 2.16.10

Description The issue arises from improper handling of certain characters in the maxpatchsize and maxattachmentsize parameters in the attachment.cgi script, allowing remote attackers to trigger a SQL error.

Recommendations For Bugzilla version 2.16.10, consider restricting access to the attachment.cgi script until a proper fix is applied, and avoid using the maxpatchsize and maxattachmentsize parameters in a way that could trigger SQL errors.

Fix

Related Identifiers

CVE-2006-0915

Affected Products

Bugzilla

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-0915 · Security Note
• http://vupen.com/english/advisories/2006/0692 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=313441 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0915 · Note