template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing private product names or private component names in certain circumstances involving custom-field visibility control, which allows remote attackers to obtain sensitive information by reading HTML source code.

Multiple vulnerablilities was identified and fixed in bugzilla :

The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not check whether an attachment is private before presenting the attachment description within a public comment, which allows remote attackers to obtain sensitive description information by reading a comment (CVE-2012-1969).

Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted login attempt (CVE-2012-3981).

Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report, as demonstrated by the Version field (CVE-2012-4189).

Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to read attachment descriptions from private bugs via an obsolete=1 insert action (CVE-2012-4197).

The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 has a different outcome for a groups request depending on whether a group exists, which allows remote authenticated users to discover private group names by observing whether a call throws an error (CVE-2012-4198).

template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing private product names or private component names in certain circumstances involving custom-field visibility control, which allows remote attackers to obtain sensitive information by reading HTML source code (CVE-2012-4199).

Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore.swf, a similar issue to CVE-2010-4209 (CVE-2012-5883).

Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to inject arbitrary web script or HTML via the id parameter in conjunction with an invalid value of the format parameter (CVE-2013-0785).

The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remote attackers to discover private product names by using debug mode for a query (CVE-2013-0786).

The updated packages have upgraded to the 4.2.5 version which is not vulnerable to these issues

According to its banner, the version of Bugzilla installed on the remote host is affected by multiple vulnerabilities :

  - Due to incorrectly filtered field values in tabular     reports, code can be injected, which could allow     cross-site scripting (XSS).  Note that this affects     versions 4.1.1 to 4.2.3 and 4.3.1 to 4.3.3.
    (CVE-2012-4189)

  - When trying to mark an attachment in a restricted bug as     obsolete, the description is disclosed in the resulting     error message.  Note that this affects versions 2.16 to     3.6.11, 3.7.1 to 4.0.8, 4.1.1 to 4.2.3, and 4.3.1 to     4.3.3. (CVE-2012-4197)

  - When calling the User.get method with a 'groups'     argument, the existence of the groups is leaked, which     could allow an attacker to identify groups via an error     message.  Note that this affects versions 3.7.1 to     4.0.8,     4.1.1 to 4.2.3, and 4.3.1 to 4.3.3. (CVE-2012-4198)

  - Custom field names are disclosed in the JavaScript     code generated when the visibility of a custom field is     controlled by a restricted product or component of a     product.  Note that this affects versions 3.3.4 to     3.6.11, 3.7.1 to 4.0.8, 4.1.1 to 4.2.3, and 4.3.1     to 4.3.3. (CVE-2012-4199)

  - A vulnerability exists in swfstore.swf from YUI2 that     could allow JavaScript injection exploits to be created     against domains hosting the affected YUI .swf file.     Note     that this affects versions 3.7.1 to 4.0.8, 4.1.1 to     4.2.3, and 4.3.1 to 4.3.3. (CVE-2012-5883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A Bugzilla Security Advisory reports : The following security issues have been discovered in Bugzilla : Information Leak If the visibility of a custom field is controlled by a product or a component of a product you cannot see, their names are disclosed in the JavaScript code generated for this custom field despite they should remain confidential.

Calling the User.get method with a 'groups' argument leaks the existence of the groups depending on whether an error is thrown or not. This method now also throws an error if the user calling this method does not belong to these groups (independently of whether the groups exist or not).

Trying to mark an attachment in a bug you cannot see as obsolete discloses its description in the error message. The description of the attachment is now removed from the error message. Cross-Site Scripting Due to incorrectly filtered field values in tabular reports, it is possible to inject code leading to XSS.

A vulnerability in swfstore.swf from YUI2 allows JavaScript injection exploits to be created against domains that host this affected YUI .swf file.

ID	Name	Product	Family	Severity
66080	Mandriva Linux Security Advisory : bugzilla (MDVSA-2013:066)	Nessus	Mandriva Local Security Checks	medium
62973	Bugzilla < 3.6.12 / 4.0.9 / 4.2.4 / 4.4rc1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
62956	FreeBSD : bugzilla -- multiple vulnerabilities (2b841f88-2e8d-11e2-ad21-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-4199

medium

Tenable Plugins

medium

medium

medium