The Bugzilla 4.5.3, 4.4.3, 4.2.8, and 4.0.12 releases fix two security issues. Quoting from <http://seclists.org/bugtraq/2014/Apr/112>: "" Class: Cross-Site Request Forgery Versions: Bugzilla 2.0 to 4.4.2, 4.5.1 to 4.5.2 Fixed In: 4.4.3, 4.5.3 Description: The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. If the victim then reports a new security sensitive bug, the attacker would get immediate access to this bug. Due to changes involved in the Bugzilla API, this fix is not backported to the 4.0 and 4.2 branches, meaning that Bugzilla 4.0.12 and older, and 4.2.8 and older, will remain vulnerable to this issue. References: https://bugzilla.mozilla.org/show_bug.cgi?id=713926 CVE Number: CVE-2014-1517 Class: Social Engineering Versions: Bugzilla 2.0 to 4.0.11, 4.1.1 to 4.2.7, 4.3.1 to 4.4.2, 4.5.1 to 4.5.2 Fixed In: 4.0.12, 4.2.8, 4.4.3, 4.5.3 Description: Dangerous control characters can be inserted into Bugzilla, notably into bug comments. If the text, which may look safe, is copied into a terminal such as xterm or gnome-terminal, then unexpected commands could be executed on the local machine. References: https://bugzilla.mozilla.org/show_bug.cgi?id=968576 CVE Number: none ""
Created bugzilla tracking bugs for this issue: Affects: fedora-all [bug 1089897] Affects: epel-all [bug 1089898]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.