CVE-2006-0914: Input Validation

Published Feb 28, 2006

Updated

Bugzilla 2.16.10, 2.17 through 2.18.4, and 2.20 does not properly handle certain characters in the mostfreqthreshold parameter in duplicates.cgi, which allows remote attackers to trigger a SQL error.

Affected Software

15 affected components

Bugzilla=2.17.6

Bugzilla=2.20-rc2

Bugzilla=2.20-rc1

Bugzilla=2.18-rc1

Bugzilla=2.17.4

Bugzilla=2.18.1

Bugzilla=2.17.5

Bugzilla=2.18.4

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.17

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=2.16.10

Remediation

Patch Available

https://bugzilla.mozilla.org/show_bug.cgi?id=312498

Event History

Feb 28, 2006

CVE Published

11:02 AM

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-0914?

CVE-2006-0914 has been classified as a moderate vulnerability due to the potential for a SQL error when specific characters are handled incorrectly.

How do I fix CVE-2006-0914?

To mitigate CVE-2006-0914, you should upgrade to a Bugzilla version that is not affected, such as any version later than 2.18.4.

What versions of Bugzilla are affected by CVE-2006-0914?

CVE-2006-0914 affects Bugzilla versions 2.16.10, 2.17 through 2.18.4, and 2.20.

What type of attack does CVE-2006-0914 facilitate?

CVE-2006-0914 allows remote attackers to trigger a SQL error by exploiting improper handling of characters.

Where can I find more information about CVE-2006-0914?

Detailed information about CVE-2006-0914, including its implications and fixes, can be found in Bugzilla's issue tracking system.