FreeBSD : bugzilla -- multiple serious vulnerabilities (c8c927e5-2891-11e0-8f26-00151735203a)

high Nessus Plugin ID 51670
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

A Bugzilla Security Advisory reports :

This advisory covers three security issues that have recently been fixed in the Bugzilla code :

- A weakness in Bugzilla could allow a user to gain unauthorized access to another Bugzilla account.

- A weakness in the Perl CGI.pm module allows injecting HTTP headers and content to users via several pages in Bugzilla.

- If you put a harmful 'javascript:' or 'data:' URL into Bugzilla's 'URL' field, then there are multiple situations in which Bugzilla will unintentionally make that link clickable.

- Various pages lack protection against cross-site request forgeries.

All affected installations are encouraged to upgrade as soon as possible.

Solution

Update the affected package.

See Also

https://bugzilla.mozilla.org/show_bug.cgi?id=621591

https://bugzilla.mozilla.org/show_bug.cgi?id=619594

https://bugzilla.mozilla.org/show_bug.cgi?id=591165

https://bugzilla.mozilla.org/show_bug.cgi?id=621572

https://bugzilla.mozilla.org/show_bug.cgi?id=619588

https://bugzilla.mozilla.org/show_bug.cgi?id=628034

https://bugzilla.mozilla.org/show_bug.cgi?id=621090

https://bugzilla.mozilla.org/show_bug.cgi?id=621105

https://bugzilla.mozilla.org/show_bug.cgi?id=621107

https://bugzilla.mozilla.org/show_bug.cgi?id=621108

https://bugzilla.mozilla.org/show_bug.cgi?id=621109

https://bugzilla.mozilla.org/show_bug.cgi?id=621110

http://www.nessus.org/u?4f3ca8a3

Plugin Details

Severity: High

ID: 51670

File Name: freebsd_pkg_c8c927e5289111e08f2600151735203a.nasl

Version: 1.11

Type: local

Published: 1/26/2011

Updated: 1/6/2021

Dependencies: ssh_get_info.nasl

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.7

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: E:F/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:bugzilla, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/25/2011

Vulnerability Publication Date: 1/24/2011

Reference Information

CVE: CVE-2010-0048, CVE-2010-2761, CVE-2010-4411, CVE-2010-4567, CVE-2010-4568, CVE-2010-4572, CVE-2011-0046

BID: 25425