Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 displays a different error message depending on whether a product exists or not, which allows remote attackers to determine hidden products.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bugzilla | Mozilla | 2.10 (including) | 2.10 (including) |
| Bugzilla | Mozilla | 2.12 (including) | 2.12 (including) |
| Bugzilla | Mozilla | 2.14 (including) | 2.14 (including) |
| Bugzilla | Mozilla | 2.14.1 (including) | 2.14.1 (including) |
| Bugzilla | Mozilla | 2.14.2 (including) | 2.14.2 (including) |
| Bugzilla | Mozilla | 2.14.3 (including) | 2.14.3 (including) |
| Bugzilla | Mozilla | 2.14.4 (including) | 2.14.4 (including) |
| Bugzilla | Mozilla | 2.14.5 (including) | 2.14.5 (including) |
| Bugzilla | Mozilla | 2.16 (including) | 2.16 (including) |
| Bugzilla | Mozilla | 2.16.1 (including) | 2.16.1 (including) |
| Bugzilla | Mozilla | 2.16.2 (including) | 2.16.2 (including) |
| Bugzilla | Mozilla | 2.16.3 (including) | 2.16.3 (including) |
| Bugzilla | Mozilla | 2.16.4 (including) | 2.16.4 (including) |
| Bugzilla | Mozilla | 2.16.5 (including) | 2.16.5 (including) |
| Bugzilla | Mozilla | 2.16.6 (including) | 2.16.6 (including) |
| Bugzilla | Mozilla | 2.16.7 (including) | 2.16.7 (including) |
| Bugzilla | Mozilla | 2.16.8 (including) | 2.16.8 (including) |
| Bugzilla | Mozilla | 2.16.9 (including) | 2.16.9 (including) |
| Bugzilla | Mozilla | 2.16.10 (including) | 2.16.10 (including) |
| Bugzilla | Mozilla | 2.18 (including) | 2.18 (including) |
| Bugzilla | Mozilla | 2.18.1 (including) | 2.18.1 (including) |
| Bugzilla | Mozilla | 2.19.1 (including) | 2.19.1 (including) |
| Bugzilla | Mozilla | 2.19.2 (including) | 2.19.2 (including) |
References
- http://distro.conectiva.com.br/atualizacoes/index.php?id=a\u0026anuncio=001040
- http://marc.info/?l=bugtraq\u0026m=111592031902962\u0026w=2
- http://secunia.com/advisories/15338
- http://www.bugzilla.org/security/2.16.8/
- http://www.osvdb.org/16425
- http://www.securityfocus.com/bid/13606
- http://www.vupen.com/english/advisories/2005/0533
- https://bugzilla.mozilla.org/show_bug.cgi?id=287109
- http://distro.conectiva.com.br/atualizacoes/index.php?id=a\u0026anuncio=001040
- http://marc.info/?l=bugtraq\u0026m=111592031902962\u0026w=2
- http://secunia.com/advisories/15338
- http://www.bugzilla.org/security/2.16.8/
- http://www.osvdb.org/16425
- http://www.securityfocus.com/bid/13606
- http://www.vupen.com/english/advisories/2005/0533
- https://bugzilla.mozilla.org/show_bug.cgi?id=287109