Cross-site scripting (XSS) vulnerability in the dependency graphs in Bugzilla 2.16rc1 through 4.4.11, and 4.5.1 through 5.0.2 allows remote attackers to inject arbitrary web script or HTML.

The bugzilla devs discovered that a specially crafted bug summary could trigger XSS in dependency graphs (CVE-2016-2803). This release fixes the issue.

----

A bug in Bugzilla caused it to send improperly formatted email addresses. This update contains the fix to this problem.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The bugzilla devs discovered that a specially crafted bug summary could trigger XSS in dependency graphs (CVE-2016-2803). This release fixes the issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bugzilla Security Advisory

A specially crafted bug summary could trigger XSS in dependency graphs. Due to an incorrect parsing of the image map generated by the dot script, a specially crafted bug summary could trigger XSS in dependency graphs.

ID	Name	Product	Family	Severity
92107	Fedora 23 : bugzilla (2016-6cdcddef2c)	Nessus	Fedora Local Security Checks	medium
92099	Fedora 22 : bugzilla (2016-5bd283c48b)	Nessus	Fedora Local Security Checks	medium
92080	Fedora 24 : bugzilla (2016-37a8cb68c5)	Nessus	Fedora Local Security Checks	medium
91203	FreeBSD : Bugzilla security issues (036d6c38-1c5b-11e6-b9e0-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-2803

medium

Tenable Plugins

medium

medium

medium

medium