A number of security-related bugs have been found in Bugzilla version 2.14. This security erratum updates Bugzilla to version 2.14.1. Bugzilla 2.14.1 is a security update; patches from a number of security-related bugs which have already been applied to the working source version 2.15 in CVS, have been applied to Bugzilla 2.14 to create the new stable release 2.14.1. This new version fixes several security issues discovered since version 2.14 was released, which are too serious to wait for the upcoming 2.16 release.
Bugzilla is a bug-tracking system from mozilla.org. A number of security issues have been found in version 2.14. This security erratum updates Bugzilla found in Red Hat Linux 6.2, 7, and 7.1 to the 2.14.1 version, which is not vulnerable to these issues. Bugzilla user account hijacking exploits: Bug 54901: If LDAP Authentication was being used, Bugzilla would allow you to log in as anyone if you left the password blank. Bug 108385: It was possible to add comments as someone else by editing the HTML on the show_bug.cgi page before submitting the form. Bug 108516: It was possible to file a bug as someone else by editing the HTML on enter_bug.cgi before submitting the form. Bugzilla account security: Bug 102141: The Product popup menu on the show_bug form listed all products, even if the user didn't have access to all of them. Bug 108821: If you had any blessgroupset privs (the ability to change only specific privileges for other users), it was possible to change your own groupset (privileges) by altering the page HTML before submitting on editusers.cgi. Untrusted variables: Bug 98146: An untrusted variable was echoed back to user in the HTML output if there was a login error while editing votes. Arbitrary SQL execution: Bug 108812: buglist.cgi had an undocumented parameter that allowed you to pass arbitrary SQL for the "WHERE" part of a query. Bug 108822: It was possible for a user to send arbitrary SQL by inserting single quotes in the "mybugslink" field in the user preferences. Bug 109679: buglist.cgi was not validating that the field names being passed from the "boolean chart" query form were valid field names, thus allowing arbitrary SQL to be inserted if you edited the HTML by hand before submitting the form. Bug 109690: long_list.cgi was not validating that the bug ID parameter was actually a number, allowing arbitrary SQL to be inserted if you edited the HTML by hand. Complete bug reports for all security issues can be obtained by visiting the URL: http://bugzilla.mozilla.org/show_bug.cgi?id=XXXXX where XXXXX should be replaced with a bug number as listed above. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2001-0007, CAN-2001-0008, CAN-2001-0009, CAN-2001-0010, CAN-2001-0011 to these issues.