CVE-2010-4572: Code Injection

Q: What is the severity of CVE-2010-4572?

CVE-2010-4572 has a moderate severity rating as it allows attackers to inject arbitrary HTTP headers.

Q: How do I fix CVE-2010-4572?

To fix CVE-2010-4572, update Bugzilla to the latest version that includes security patches addressing this vulnerability.

Q: What versions of Bugzilla are affected by CVE-2010-4572?

CVE-2010-4572 affects Bugzilla versions before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2.

Q: What types of attacks can be conducted using CVE-2010-4572?

Attackers can use CVE-2010-4572 to conduct HTTP response splitting attacks through CRLF injection.

Q: Is CVE-2010-4572 related to any other vulnerabilities?

CVE-2010-4572 is a different vulnerability than CVE-2010-276 despite both relating to security issues in Bugzilla.

Published Jan 28, 2011

Updated

CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the query string, a different vulnerability than CVE-2010-2761 and CVE-2010-4411.

Affected Software

109 affected components

Bugzilla=2.0

Bugzilla=2.18.6\+

Bugzilla=2.16.8

Bugzilla=2.22.7

Bugzilla=3.4.3

Bugzilla=2.16_rc2

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.16-rc2

Bugzilla=3.2-rc1

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=3.6.1

Bugzilla=3.2.6

Bugzilla=3.6.0

Bugzilla=3.4.2

Bugzilla=2.16.2

Bugzilla=2.16.11

Bugzilla=3.6.3

Bugzilla=3.2.5

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.16-rc1

Bugzilla=2.23.2

Bugzilla=2.21.2

Bugzilla=2.10

Bugzilla=2.17.1

Bugzilla=3.2.3

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=2.23.4

Bugzilla=2.16.9

Bugzilla=3.4.9

Bugzilla=2.20.1

Bugzilla=2.23.3

Bugzilla=2.14.2

Bugzilla=3.2.8

Bugzilla=2.18.7

Bugzilla=2.23.1

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.22.5

Bugzilla=3.4.1

Bugzilla=3.4.4

Bugzilla=2.14.4

Bugzilla=3.4.8

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.6

Bugzilla=3.4.7

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=2.17.3

Bugzilla=2.4

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=3.2

Bugzilla=2.20.3

Bugzilla=2.8

Bugzilla=3.2.4

Bugzilla=2.2

Bugzilla=2.18.4

Bugzilla=3.2.2

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.18.9

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.7

Bugzilla=4.0-rc1

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla<=3.2.9

Bugzilla=2.17

Bugzilla=2.23

Bugzilla=2.16.6

Bugzilla=3.2.7

Bugzilla=2.9

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=3.4.5

Bugzilla=3.2-rc2

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=3.2.1

Bugzilla=2.16.5

Bugzilla=3.4.6

Bugzilla=3.6.2

Bugzilla=2.14

Bugzilla=4.0

Bugzilla=2.19.2

Bugzilla=2.16.10

Remediation

Patch Available

https://bugzilla.mozilla.org/show_bug.cgi?id=621572

Event History

Jan 28, 2011

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-4572?

CVE-2010-4572 has a moderate severity rating as it allows attackers to inject arbitrary HTTP headers.

How do I fix CVE-2010-4572?