Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bugzilla | Mozilla | 2.14 (including) | 2.14 (including) |
| Bugzilla | Mozilla | 2.14.1 (including) | 2.14.1 (including) |
| Bugzilla | Mozilla | 2.16 (including) | 2.16 (including) |
| Bugzilla | Mozilla | 2.16-rc1 (including) | 2.16-rc1 (including) |
| Red Hat Powertools 7.0 | RedHat | * | |
| Red Hat Powertools 7.1 | RedHat | * |