Some serious security issues were discovered in Bugzilla and have been fixed in 3.4.10 and 3.6.4.

See http://www.bugzilla.org/security/3.2.9/ for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in perl-CGI :

Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors. NOTE: this issue exists because of an incomplete fix for CVE-2010-2761 (CVE-2010-4411).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been upgraded to the latest version (3.51) which is not affected by this issue and in turn also brings many bugfixes.

The remote host is affected by the vulnerability described in GLSA-201110-03 (Bugzilla: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Bugzilla. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct cross-site scripting attacks, conduct       script insertion and spoofing attacks, hijack the authentication of       arbitrary users, inject arbitrary HTTP headers, obtain access to       arbitrary accounts, disclose the existence of confidential groups and its       names, or inject arbitrary e-mail headers.
    A local attacker could disclose the contents of temporarfy files for       uploaded attachments.
  Workaround :

    There is no known workaround at this time.

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.
CVE-2010-2761, CVE-2010-4410 and CVE-2010-4411 have been assigned to this issue.

SunOS 5.10: Apache 2 mod_perl Perl cgi pat.
Date this patch was last updated by Sun : Apr/20/11

The following vulnerabilities have been fixed in perl-CGI-Simple:
CVE-2010-4410 - crlf injection CVE-2010-4411 - incomplete fix for crlf injection

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
51855	Fedora 14 : bugzilla-3.6.4-1.fc14 (2011-0741)	Nessus	Fedora Local Security Checks	2011/2/3	2021/1/11	high
51800	Mandriva Linux Security Advisory : perl-CGI (MDVSA-2011:008)	Nessus	Mandriva Local Security Checks	2011/1/28	2021/1/6	medium
56445	GLSA-201110-03 : Bugzilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2011/10/11	2021/1/6	high
51856	Fedora 13 : bugzilla-3.4.10-1.fc13 (2011-0755)	Nessus	Fedora Local Security Checks	2011/2/3	2021/1/11	high
75705	openSUSE Security Update : perl (openSUSE-SU-2011:0064-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
107527	Solaris 10 (sparc) : 141552-04	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/23	medium
75709	openSUSE Security Update : perl-CGI-Simple (openSUSE-SU-2011:0083-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium

检测

插件搜索

high

medium

high

high

medium

medium

medium