Bug 445819 (CVE-2008-2103)

Summary:	CVE-2008-2103 bugzilla: Cross-Site Scripting in the the "Format for Printing" view
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	john
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2103
Whiteboard:
Fixed In Version:	3.0.4-1.fc9	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-05-13 15:26:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	445821, 445822, 445823
Bug Blocks:

Description Tomas Hoger 2008-05-09 09:56:54 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2103 to the following vulnerability:

Cross-site scripting (XSS) vulnerability in Bugzilla 2.17.2 and later allows remote attackers to inject arbitrary web script or HTML via the id parameter to the "Format for Printing" view or "Long Format" bug list.

Fixed upstream in: 3.0.4, 3.1.4, 2.22.4, and 2.20.6

Refences:
http://www.bugzilla.org/security/2.20.5/
https://bugzilla.mozilla.org/show_bug.cgi?id=425665
http://www.securityfocus.com/bid/29038
http://www.frsirt.com/english/advisories/2008/1428/references
http://www.securitytracker.com/id?1019967
http://secunia.com/advisories/30064
http://xforce.iss.net/xforce/xfdb/42216

Comment 1 Tomas Hoger 2008-05-09 10:01:32 UTC

Affects Fedora and EPEL5.

Comment 3 Fedora Update System 2008-05-09 14:05:26 UTC

bugzilla-3.0.4-1.fc7 has been submitted as an update for Fedora 7

Comment 4 Fedora Update System 2008-05-09 14:06:45 UTC

bugzilla-3.0.4-1.fc8 has been submitted as an update for Fedora 8

Comment 5 Fedora Update System 2008-05-09 14:08:00 UTC

bugzilla-3.0.4-1.fc9 has been submitted as an update for Fedora 9

Comment 6 Fedora Update System 2008-05-10 13:51:16 UTC

bugzilla-3.0.4-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2008-05-10 13:57:24 UTC

bugzilla-3.0.4-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Red Hat Product Security 2008-05-13 15:04:34 UTC

This issue was addressed in:

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2008-3488
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-3442
  https://admin.fedoraproject.org/updates/F9/FEDORA-2008-3668

Comment 9 Fedora Update System 2008-05-13 15:26:41 UTC

bugzilla-3.0.4-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.