Bug 623423 - (CVE-2010-2756, CVE-2010-2757, CVE-2010-2758, CVE-2010-2759) CVE-2010-2756 CVE-2010-2757 CVE-2010-2758 CVE-2010-2759 bugzilla: multiple vulnerabilities corrected in 3.4.8/3.6.2
CVE-2010-2756 CVE-2010-2757 CVE-2010-2758 CVE-2010-2759 bugzilla: multiple vu...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
public=20100805,reported=20100811,sou...
: Security
Depends On: 623426
Blocks:
  Show dependency treegraph
 
Reported: 2010-08-11 14:44 EDT by Vincent Danen
Modified: 2010-08-28 04:16 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-08-28 04:16:54 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2010-08-11 14:44:09 EDT
Upstream Bugzilla has released 3.4.8 and 3.6.2 to address four security flaws [1]:

Vulnerability Details
=====================

Class:       Remote Information Disclosure
Versions:    2.19.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1,
             3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: An unprivileged user is normally not allowed to view
             other users' group membership. But boolean charts
             let the user use group-based pronouns, indirectly
             disclosing group membership. This security fix
             restricts the use of pronouns to groups the user
             belongs to.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=417048
CVE Number:  CVE-2010-2756

Class:       Notification Bypass
Versions:    2.22rc1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1,
             3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: Normally, when a user is impersonated, he receives
             an email informing him that he is being impersonated,
             containing the identity of the impersonator. However,
             it was possible to impersonate a user without this
             notification being sent.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=450013
CVE Number:  CVE-2010-2757

Class:       Remote Information Disclosure
Versions:    2.17.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1,
             3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: An error message thrown by the "Reports" and "Duplicates"
             page confirmed the non-existence of products, thus
             allowing users to guess confidential product names.
             (Note that the "Duplicates" page was not vulnerable
             in Bugzilla 3.6rc1 and above though.)
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=577139
             https://bugzilla.mozilla.org/show_bug.cgi?id=519835
CVE Number:  CVE-2010-2758

Class:       Denial of Service
Versions:    2.23.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1,
             3.7 to 3.7.2
Fixed In:    3.2.8, 3.4.8, 3.6.2, 3.7.3
Description: If a comment contained the phrases "bug X" or
             "attachment X", where X was an integer larger than the
             maximum 32-bit signed integer size, PostgreSQL would
             throw an error, and any page containing that comment would
             not be viewable. On most Bugzillas, any user can enter
             a comment on any bug, so any user could have used this to
             deny access to one or all bugs. Bugzillas running on
             databases other than PostgreSQL are not affected.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=583690
CVE Number:  CVE-2010-2759

[1] http://www.bugzilla.org/security/3.2.7/
Comment 1 Vincent Danen 2010-08-11 14:46:15 EDT
Created bugzilla tracking bugs for this issue

Affects: fedora-all [bug 623426]
Comment 2 Emmanuel Seyman 2010-08-28 04:16:54 EDT
Errata has been released.

Note You need to log in before you can comment on or make changes to this bug.