oss-security - CVE request: Bugzilla (Unauthorized Bug Change, XSS, Account Impersonation)

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 07 May 2008 20:42:47 +0200
From: Christian Hoffmann <hoffie@...too.org>
To: coley@...re.org
CC: oss-security@...ts.openwall.com
Subject: CVE request: Bugzilla (Unauthorized Bug Change, XSS, Account Impersonation)

Hi,

can we please get CVE ids assigned for the three issues mentioned in the 
release announcement [1] of the new bugzilla versions?

"""
* Users without the "canconfirm" privilege could enter a bug as
   NEW or ASSIGNED by using the XML-RPC interface.

* When viewing several bugs at once, there was a Cross-Site
   Scripting hole.

* The inbound email interface allowed you to set the Reporter via
   the text of the email, instead of just using the From header.
"""

[1] http://www.bugzilla.org/security/2.20.5/

Thanks,
-- 
Christian Hoffmann

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.