220799 CVE-2008-2103 2008-05-07 18:38 0000 www-apps/bugzilla <2.20.6, 2.22.4, 3.0.4: multiple vulnerabilities (CVE-2008-{2103,2104,2105}) 2008-06-01 20:56:13 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All All RESOLVED FIXED http://www.bugzilla.org/security/2.20.5/ B4 [noglsa] P2 normal --- 1 hoffie@gentoo.org security@gentoo.org infra-bugs@gentoo.org vladimir@greenmice.info hoffie@gentoo.org 2008-05-07 18:38:19 0000 See $URL <3.1.4 (we do not seem to ship 3.1.x): Unauthorized Bug Change <2.20.6, <2.22.4, <3.0.4, <3.1.4: XSS <3.0.4, <3.1.4: Account Impersonation Requesting CVEs. hoffie@gentoo.org 2008-05-07 20:14:12 0000 Unauthorized Bug Change: CVE-2008-2104 XSS: CVE-2008-2103 Account Impersonation: CVE-2008-2105 (according to Steve's interpretation, only 2.23.x < 3.x is affected, so we do not even ship a version which is affected by this). wrobel@gentoo.org 2008-05-17 07:30:35 0000 The new versions are in the tree. Targets: - 2.20.6: alpha amd64 ia64 ppc ppc64 sparc x86 - 2.22.4: ia64 ppc ppc64 sparc x86 - 3.0.4: alpha amd64 ia64 ppc ppc64 sparc x86 corsair@gentoo.org 2008-05-18 14:38:56 0000 ppc64 stable maekke@gentoo.org 2008-05-18 16:25:27 0000 amd64/x86 stable armin76@gentoo.org 2008-05-20 14:26:57 0000 alpha/ia64/sparc stable dertobi123@gentoo.org 2008-05-20 16:37:36 0000 ppc stable pva@gentoo.org 2008-05-21 09:45:27 0000 Fixed in release snapshot. wrobel@gentoo.org 2008-06-01 14:28:14 0000 Removed vulnerable versions. webapps done. py@gentoo.org 2008-06-01 17:50:57 0000 Time for glsa vote here. I vote NO. keytoaster@gentoo.org 2008-06-01 20:56:13 0000 NO, too, and closing.