Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 428334 (CVE-2012-1968) - <www-apps/bugzilla-{3.6.10,4.0.7,4.2.2}: Information Leaks (CVE-2012-{1968,1969})
Summary: <www-apps/bugzilla-{3.6.10,4.0.7,4.2.2}: Information Leaks (CVE-2012-{1968,19...
Alias: CVE-2012-1968
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B4 [noglsa]
Depends on: CVE-2013-0785
Blocks: CVE-2012-0465
  Show dependency tree
Reported: 2012-07-27 15:46 UTC by Sean Amoss (RETIRED)
Modified: 2013-09-23 11:45 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Sean Amoss (RETIRED) gentoo-dev Security 2012-07-27 15:46:06 UTC
From the upstream advisory at $URL:


Bugzilla is a Web-based bug-tracking system used by a large number of
software projects. The following security issues have been discovered
in Bugzilla:

* In HTML bugmails, an improper validation of the permissions of the
  addressee can lead to confidential information about bugs and
  attachments to be visible to the addressee.

* The description of a private attachment can be visible to a user
  who hasn't permissions to access this attachment if the attachment
  ID is mentioned in a comment in a bug.

All affected installations are encouraged to upgrade as soon as

Vulnerability Details

Class:       Information Leak
Versions:    4.1.1 to 4.2.1, 4.3.1
Fixed In:    4.2.2, 4.3.2
Description: In HTML bugmails, all bug IDs and attachment IDs are
             linkified, and hovering these links displays a tooltip
             with the bug summary or the attachment description if
             the user is allowed to see the bug or attachment.
             But when validating user permissions when generating the
             email, the permissions of the user who edited the bug were
             taken into account instead of the permissions of the
             addressee. This means that confidential information could
             be disclosed to the addressee if the other user has more
             privileges than the addressee.
             Plain text bugmails are not affected as bug and attachment
             IDs are not linkified.
CVE Number:  CVE-2012-1968

Class:       Information Leak
Versions:    2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to 4.2.1, 4.3.1
Fixed In:    3.6.10, 4.0.7, 4.2.2, 4.3.2
Description: The description of a private attachment could be visible
             to a user who hasn't permissions to access this attachment
             if the attachment ID is mentioned in a public comment in
             a bug that the user can see.
CVE Number:  CVE-2012-1969

Vulnerability Solutions

The fixes for these issues are included in the 3.6.10, 4.0.7, 4.2.2 and
4.3.2 releases. Upgrading to a release with the relevant fixes will
protect your installation from possible exploits of these issues.

If you are unable to upgrade but would like to patch just these
individual security vulnerabilities, there are patches available for
the issues at the "References" URL for each vulnerability.

Full release downloads, patches to upgrade Bugzilla from previous
versions, and CVS/bzr upgrade instructions are available at:


The Bugzilla team wish to thank the following people/organizations for
their assistance in locating, advising us of, and assisting us in
fixing these issues:

Frédéric Buclin
Byron Jones
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2012-07-30 18:30:56 UTC
CVE-2012-1969 (
  The get_attachment_link function in in Bugzilla 2.x and 3.x
  before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2,
  and 4.3.x before 4.3.2 does not check whether an attachment is private
  before presenting the attachment description within a public comment, which
  allows remote attackers to obtain sensitive description information by
  reading a comment.

CVE-2012-1968 (
  Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor
  permissions instead of bugmail-recipient permissions during construction of
  HTML bugmail documents, which allows remote attackers to obtain sensitive
  description information by reading the tooltip portions of an HTML e-mail