CVE-2010-2759: Medium severity Bugzilla vulnerability

Published Aug 13, 2010

Updated

Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2, when PostgreSQL is used, does not properly handle large integers in (1) bug and (2) attachment phrases, which allows remote authenticated users to cause a denial of service (bug invisibility) via a crafted comment.

Affected Software

52 affected components

Bugzilla=3.0.4

Bugzilla=3.0-rc1

Bugzilla=3.1.3

Bugzilla=3.0.0

Bugzilla=3.7.2

Bugzilla=3.4.3

Bugzilla=3.3.2

Bugzilla=3.0.1

Bugzilla=3.6.1

Bugzilla=3.2.6

Bugzilla=3.1.1

Bugzilla=3.7.1

Bugzilla=3.7

Bugzilla=3.4.2

Bugzilla=3.1.2

Bugzilla=3.5.3

Bugzilla=3.2.5

Bugzilla=3.3.4

Bugzilla=3.6

Bugzilla=2.23.2

Bugzilla=3.2.3

Bugzilla=2.23.4

Bugzilla=3.5.2

Bugzilla=3.0

Bugzilla=3.5.1

Bugzilla=3.0.11

Bugzilla=3.0.6

Bugzilla=2.23.3

Bugzilla=3.0.7

Bugzilla=2.23.1

Bugzilla=3.4.1

Bugzilla=3.4.4

Bugzilla=2.6

Bugzilla=3.4.7

Bugzilla=3.1.0

Bugzilla=2.4

Bugzilla=3.0.3

Bugzilla=3.2

Bugzilla=3.0.9

Bugzilla=2.8

Bugzilla=3.2.4

Bugzilla=3.0.2

Bugzilla=3.3.3

Bugzilla=3.2.2

Bugzilla=3.0.10

Bugzilla=3.0.8

Bugzilla=3.2.7

Bugzilla=2.9

Bugzilla=3.4.5

Bugzilla=3.0.5

Bugzilla=3.3.1

Bugzilla=3.4.6

Event History

Aug 13, 2010

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-2759?

CVE-2010-2759 has a medium severity rating due to potential denial of service vulnerabilities.

How do I fix CVE-2010-2759?

To fix CVE-2010-2759, you should upgrade to Bugzilla versions 3.2.7 or later, or apply the corresponding patches.

Which versions of Bugzilla are affected by CVE-2010-2759?

CVE-2010-2759 affects Bugzilla versions from 2.23.1 through 3.2.7 and 3.3.1 through 3.7.2.

What kind of attack does CVE-2010-2759 enable?

CVE-2010-2759 enables authenticated users to exploit the vulnerability to cause bug invisibility, leading to denial of service.

Who is primarily affected by CVE-2010-2759?

Organizations using implicated versions of Bugzilla with PostgreSQL are primarily affected by CVE-2010-2759.