From lpsolit at gmail.com Wed Nov 14 12:23:40 2012 From: lpsolit at gmail.com (=?ISO-8859-1?Q?Fr=E9d=E9ric_Buclin?=) Date: Wed, 14 Nov 2012 13:23:40 +0100 Subject: Security advisory for Bugzilla 4.4rc1, 4.2.4, 4.0.9 and 3.6.12 Message-ID: <50A38D4C.4040301@gmail.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: * Confidential product and component names can be disclosed to unauthorized users if they are used to control the visibility of a custom field. * When calling the 'User.get' WebService method with a 'groups' argument, it is possible to check if the given group names exist or not. * Due to incorrectly filtered field values in tabular reports, it is possible to inject code which can lead to XSS. * When trying to mark an attachment in a bug you cannot see as obsolete, the description of the attachment is disclosed in the error message. * A vulnerability in swfstore.swf from YUI2 can lead to XSS. All affected installations are encouraged to upgrade as soon as possible. Vulnerability Details ===================== Class: Information Leak Versions: 3.3.4 to 3.6.11, 3.7.1 to 4.0.8, 4.1.1 to 4.2.3, 4.3.1 to 4.3.3 Fixed In: 3.6.12, 4.0.9, 4.2.4, 4.4rc1 Description: If the visibility of a custom field is controlled by a product or a component of a product you cannot see, their names are disclosed in the JavaScript code generated for this custom field despite they should remain confidential. References: https://bugzilla.mozilla.org/show_bug.cgi?id=731178 CVE Number: CVE-2012-4199 Class: Information Leak Versions: 3.7.1 to 4.0.8, 4.1.1 to 4.2.3, 4.3.1 to 4.3.3 Fixed In: 4.0.9, 4.2.4, 4.4rc1 Description: Calling the User.get method with a 'groups' argument leaks the existence of the groups depending on whether an error is thrown or not. This method now also throws an error if the user calling this method does not belong to these groups (independently of whether the groups exist or not). References: https://bugzilla.mozilla.org/show_bug.cgi?id=781850 CVE Number: CVE-2012-4198 Class: Cross-Site Scripting Versions: 4.1.1 to 4.2.3, 4.3.1 to 4.3.3 Fixed In: 4.2.4, 4.4rc1 Description: Due to incorrectly filtered field values in tabular reports, it is possible to inject code leading to XSS. References: https://bugzilla.mozilla.org/show_bug.cgi?id=790296 CVE Number: CVE-2012-4189 Class: Information Leak Versions: 2.16 to 3.6.11, 3.7.1 to 4.0.8, 4.1.1 to 4.2.3, 4.3.1 to 4.3.3 Fixed In: 3.6.12, 4.0.9, 4.2.4, 4.4rc1 Description: Trying to mark an attachment in a bug you cannot see as obsolete discloses its description in the error message. The description of the attachment is now removed from the error message. References: https://bugzilla.mozilla.org/show_bug.cgi?id=802204 CVE Number: CVE-2012-4197 Class: Cross-Site Scripting Versions: 3.7.1 to 4.0.8, 4.1.1 to 4.2.3, 4.3.1 to 4.3.3 Fixed In: 4.0.9, 4.2.4, 4.4rc1 Description: A vulnerability in swfstore.swf from YUI2 allows JavaScript injection exploits to be created against domains that host this affected YUI .swf file. References: https://bugzilla.mozilla.org/show_bug.cgi?id=808845 http://yuilibrary.com/support/20121030-vulnerability/ CVE Number: CVE-2012-5475 Vulnerability Solutions ======================= The fixes for these issues are included in the 3.6.12, 4.0.9, 4.2.4 and 4.4rc1 releases. Upgrading to a release with the relevant fixes will protect your installation from possible exploits of these issues. If you are unable to upgrade but would like to patch just the individual security vulnerabilities, there are patches available for each issue at the "References" URL for each vulnerability. Full release downloads, patches to upgrade Bugzilla from previous versions, and CVS/bzr upgrade instructions are available at: http://www.bugzilla.org/download/ Credits ======= The Bugzilla team wish to thank the following people/organizations for their assistance in locating, advising us of, and assisting us to fix this issue: Fr?d?ric Buclin David Lawrence Gervase Markham Mateusz Goik General information about the Bugzilla bug-tracking system can be found at: http://www.bugzilla.org/ Comments and follow-ups can be directed to the mozilla.support.bugzilla newsgroup or the support-bugzilla mailing list. http://www.bugzilla.org/support/ has directions for accessing these forums. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQIcBAEBAgAGBQJQo41MAAoJEJZXZhv5X1hqXOMQAIyG7gZTlmERbfZKSvyvWP90 hY/PzClqJAQ/TWTj87lyAob/Svo+ejzsvv5Iu5nmQ86MeYHH+QkLQzOgHtH82tz/ 4m+ovDQqAZLig5YsKayEbsvYHOdBkEohq5XBOUrB5OOUKknUUK3nhz5E0hAJSkYZ kniaoNSqmSu8tLkrgRlp3sj+EpclhXT2y0HCVIZuRZgUICVXjzt1lvNXCxYuuv7H TJZh2kTZyIjMY6aJ9H3YkuaKE9fqzQUklEKQ57QnISRDLNYp0yyLyBnH1N98V/da 7WbMKBIQDSdSe2VPmujd3gMlNRdZCPakA7sYWgff6kMYsgvxmotYi4D7ffJzQ+fg IFSOiwET18DluP0hKHs8PgCF3micQjR0nNXw1+X7Sm1TJfMz2GSX536FrWzjqgvA T6oyFx6HoGuWa2+7lbGmLC5EmIIKG7fhjs5R5mf5BaNTBpEivd2Q3zhut+H/96Eg TKoj6efYY767btFQafbo6dRVCdn8mm7krRhSMx4wKbELdFMEBOOz4RDd1AyR++dj SC84VSc5Z8tFHUhBW37Vj/OKNxXrWqdpFm9QMeRSsiW13MVFKHJFeQDvwblOXYak fTqEZ9eF2JWRYw49t/f9PhxjVCB+oacLiyj4PI6RFrlWLqyqEOMqYfTjgWXvc9yW LykSW93eyaKTpasbkSi4 =frUy -----END PGP SIGNATURE----- From dkl at mozilla.com Wed Nov 14 15:19:40 2012 From: dkl at mozilla.com (David Lawrence) Date: Wed, 14 Nov 2012 10:19:40 -0500 Subject: [ANN] Release of Bugzilla 4.4rc1, 4.2.4, 4.0.9, and 3.612 Message-ID: <50A3B68C.3000601@mozilla.com> Today we are releasing 4.2.4, 4.0.9, 3.6.12, and the release candidate 4.4rc1. All of today's releases contain security fixes. We recommend all Bugzilla administrators to read the Security Advisory linked below. Bugzilla 4.2.4 is our latest stable release. It contains various useful bug fixes and security fixes for the 4.2 branch. Bugzilla 4.0.9 and 3.6.12 are security updates for the 4.0 branch and the 3.6 branch, respectively. 4.0.9 contains several useful bug fixes and 3.6.12 contains one as well. Bugzilla 4.4rc1 is our first Release Candidate for Bugzilla 4.4. This release has received QA testing, and should be considerably more stable than the development releases before it. It is still not considered fully stable, and so you should understand that if you use it, you use it at your own risk If feedback from this release candidate indicates that it is mostly stable, then Bugzilla 4.4 will be released in a few weeks. If feedback indicates that more extensive fixes are needed, there may be another release candidate after this one. Note that when Bugzilla 4.4 is released, the Bugzilla 3.6.x series will reach end of life. If you are using that series, we encourage you to upgrade to 4.2.4 now. Download -------- Bugzilla is available at: http://www.bugzilla.org/download/ Security Advisory ----------------- There is a security advisory describing the security issues fixed in these releases, at: http://www.bugzilla.org/security/3.6.11/ Release Notes & Changes ----------------------- Before installing or upgrading, you should read the Release Notes for the new version of Bugzilla: 4.2.4: http://www.bugzilla.org/releases/4.2.4/release-notes.html 4.0.9: http://www.bugzilla.org/releases/4.0.9/release-notes.html 3.6.12: http://www.bugzilla.org/releases/3.6.12/release-notes.html It is VERY IMPORTANT to read the Release Notes if you are upgrading from one major version to another (like 3.6.x to 4.2.x). To see a list of all changes between your version of Bugzilla and the current version of Bugzilla, you can use the chart at: http://www.bugzilla.org/status/changes.html Follow Along ------------ You can see the latest updates from the Bugzilla Project and the status of Bugzilla development on Planet Bugzilla. http://planet.bugzilla.org/ Report Bugs ----------- If you find a bug in Bugzilla, please report it! Instructions are at this URL: http://www.bugzilla.org/developers/reporting_bugs.html Support ------- You can ask questions for free on the mailing lists (or in IRC) about Bugzilla, or you can hire a paid consultant to help you out: Free Support: http://www.bugzilla.org/support/ Paid Support: http://www.bugzilla.org/support/consulting.html About Bugzilla -------------- Bugzilla is a "Defect Tracking System" or "Bug-Tracking System." Defect Tracking Systems allow individuals or groups of developers to keep track of outstanding bugs in their product effectively. Most commercial defect-tracking software vendors charge enormous licensing fees. Despite being "free", Bugzilla has many features its expensive counterparts lack. Consequently, Bugzilla has quickly become a favorite of thousands of organizations across the globe, and is widely regarded as one of the top defect-tracking systems available. See http://www.bugzilla.org/about/ for more details. - David Lawrence Release Manager, Bugzilla Project