Lucene search

K
mageiaGentoo FoundationMGASA-2015-0048
HistoryJan 31, 2015 - 4:23 p.m.

Updated bugzilla packages fix CVE-2014-8630

2015-01-3116:23:52
Gentoo Foundation
advisories.mageia.org
20

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

0.003

Percentile

72.1%

Updated bugzilla packages fix security vulnerability: Some code in Bugzilla does not properly utilize 3 arguments form for open() and it is possible for an account with editcomponents permissions to inject commands into product names and other attributes (CVE-2014-8630).

OSVersionArchitecturePackageVersionFilename
Mageia4noarchbugzilla< 4.4.8-1bugzilla-4.4.8-1.mga4

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

0.003

Percentile

72.1%