CVE-2011-2381: Code Injection
First published: Tue Aug 09 2011(Updated: )
CRLF injection vulnerability in Bugzilla 2.17.1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to inject arbitrary e-mail headers via an attachment description in a flagmail notification.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Bugzilla | =2.22.7 | |
| Mozilla Bugzilla | =2.17.6 | |
| Mozilla Bugzilla | =2.18.5 | |
| Mozilla Bugzilla | =2.19.3 | |
| Mozilla Bugzilla | =2.20-rc2 | |
| Mozilla Bugzilla | =2.18.6 | |
| Mozilla Bugzilla | =2.20-rc1 | |
| Mozilla Bugzilla | =2.20 | |
| Mozilla Bugzilla | =2.19 | |
| Mozilla Bugzilla | =2.18-rc1 | |
| Mozilla Bugzilla | =2.20.5 | |
| Mozilla Bugzilla | =2.20.6 | |
| Mozilla Bugzilla | =2.22.3 | |
| Mozilla Bugzilla | =2.22.6 | |
| Mozilla Bugzilla | =2.17.4 | |
| Mozilla Bugzilla | =2.21.2 | |
| Mozilla Bugzilla | =2.17.1 | |
| Mozilla Bugzilla | =2.22.1 | |
| Mozilla Bugzilla | =2.20.1 | |
| Mozilla Bugzilla | =2.22.2 | |
| Mozilla Bugzilla | =2.18.1 | |
| Mozilla Bugzilla | =2.22-rc1 | |
| Mozilla Bugzilla | =2.22.5 | |
| Mozilla Bugzilla | =2.19.1 | |
| Mozilla Bugzilla | =2.17.5 | |
| Mozilla Bugzilla | =2.22 | |
| Mozilla Bugzilla | =2.17.3 | |
| Mozilla Bugzilla | =2.20.3 | |
| Mozilla Bugzilla | =2.18.4 | |
| Mozilla Bugzilla | =2.18 | |
| Mozilla Bugzilla | =2.18.3 | |
| Mozilla Bugzilla | =2.17.7 | |
| Mozilla Bugzilla | =2.20.7 | |
| Mozilla Bugzilla | =2.20.2 | |
| Mozilla Bugzilla | =2.20.4 | |
| Mozilla Bugzilla | =2.21.1 | |
| Mozilla Bugzilla | =2.18-rc3 | |
| Mozilla Bugzilla | =2.18.2 | |
| Mozilla Bugzilla | =2.18-rc2 | |
| Mozilla Bugzilla | =2.22.4 | |
| Mozilla Bugzilla | =2.21 | |
| Mozilla Bugzilla | =2.19.2 | |
| Mozilla Bugzilla | =3.4.3 | |
| Mozilla Bugzilla | =3.4.2 | |
| Mozilla Bugzilla | =3.4.9 | |
| Mozilla Bugzilla | =3.4.1 | |
| Mozilla Bugzilla | =3.4.10 | |
| Mozilla Bugzilla | =3.4.4 | |
| Mozilla Bugzilla | =3.4.8 | |
| Mozilla Bugzilla | =3.4.7 | |
| Mozilla Bugzilla | =3.4.11 | |
| Mozilla Bugzilla | =3.4 | |
| Mozilla Bugzilla | =3.4.5 | |
| Mozilla Bugzilla | =3.4-rc1 | |
| Mozilla Bugzilla | =3.4.6 | |
| Mozilla Bugzilla | =3.5.3 | |
| Mozilla Bugzilla | =3.5.2 | |
| Mozilla Bugzilla | =3.5.1 | |
| Mozilla Bugzilla | =3.5 | |
| Mozilla Bugzilla | =3.6.1 | |
| Mozilla Bugzilla | =3.6.0 | |
| Mozilla Bugzilla | =3.6.3 | |
| Mozilla Bugzilla | =3.6 | |
| Mozilla Bugzilla | =3.6.4 | |
| Mozilla Bugzilla | =3.6-rc1 | |
| Mozilla Bugzilla | =3.6.5 | |
| Mozilla Bugzilla | =3.6.2 | |
| Mozilla Bugzilla | =3.7.2 | |
| Mozilla Bugzilla | =3.7.1 | |
| Mozilla Bugzilla | =3.7 | |
| Mozilla Bugzilla | =3.7.3 | |
| Mozilla Bugzilla | =4.0.1 | |
| Mozilla Bugzilla | =4.0-rc2 | |
| Mozilla Bugzilla | =4.0-rc1 | |
| Mozilla Bugzilla | =4.0 | |
| Mozilla Bugzilla | =4.1.1 | |
| Mozilla Bugzilla | =4.1 | |
| Mozilla Bugzilla | =4.1.2 | |
| Mozilla Bugzilla | =3.0.4 | |
| Mozilla Bugzilla | =3.0-rc1 | |
| Mozilla Bugzilla | =3.1.3 | |
| Mozilla Bugzilla | =3.0.0 | |
| Mozilla Bugzilla | =3.3.2 | |
| Mozilla Bugzilla | =3.0.1 | |
| Mozilla Bugzilla | =3.2-rc1 | |
| Mozilla Bugzilla | =3.2.6 | |
| Mozilla Bugzilla | =3.1.1 | |
| Mozilla Bugzilla | =3.1.2 | |
| Mozilla Bugzilla | =3.2.5 | |
| Mozilla Bugzilla | =3.3.4 | |
| Mozilla Bugzilla | =3.2.9 | |
| Mozilla Bugzilla | =3.2.10 | |
| Mozilla Bugzilla | =3.2.3 | |
| Mozilla Bugzilla | =3.0 | |
| Mozilla Bugzilla | =3.0.11 | |
| Mozilla Bugzilla | =3.0.6 | |
| Mozilla Bugzilla | =3.0.7 | |
| Mozilla Bugzilla | =3.2.8 | |
| Mozilla Bugzilla | =3.1.4 | |
| Mozilla Bugzilla | =3.1.0 | |
| Mozilla Bugzilla | =3.0.3 | |
| Mozilla Bugzilla | =3.2 | |
| Mozilla Bugzilla | =3.0.9 | |
| Mozilla Bugzilla | =3.2.4 | |
| Mozilla Bugzilla | =3.0.2 | |
| Mozilla Bugzilla | =3.3.3 | |
| Mozilla Bugzilla | =3.2.2 | |
| Mozilla Bugzilla | =3.3 | |
| Mozilla Bugzilla | =3.0.10 | |
| Mozilla Bugzilla | =3.0.8 | |
| Mozilla Bugzilla | =3.2.7 | |
| Mozilla Bugzilla | =3.2-rc2 | |
| Mozilla Bugzilla | =3.0.5 | |
| Mozilla Bugzilla | =3.2.1 | |
| Mozilla Bugzilla | =3.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2011-2381?
CVE-2011-2381 is classified as a moderate severity vulnerability, allowing for potential exploitation through CRLF injection.
What versions of Bugzilla are affected by CVE-2011-2381?
CVE-2011-2381 affects Bugzilla versions 2.17.1 through 2.22.7, and multiple versions up to and including 4.0.x before 4.0.2 and 4.1.x before 4.1.3.
How do I fix CVE-2011-2381?
To fix CVE-2011-2381, upgrade Bugzilla to version 4.1.3 or later.
What type of attack does CVE-2011-2381 facilitate?
CVE-2011-2381 allows remote attackers to inject arbitrary e-mail headers via an attachment description.
Is there a known exploit for CVE-2011-2381?
There are no public exploits specifically targeting CVE-2011-2381, but the vulnerability can be leveraged for email header injection attacks.
- collector/nvd-historical
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/author
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/mozilla
- canonical/mozilla bugzilla
- version/mozilla bugzilla/2.22.7
- version/mozilla bugzilla/2.17.6
- version/mozilla bugzilla/2.18.5
- version/mozilla bugzilla/2.19.3
- version/mozilla bugzilla/2.20-rc2
- version/mozilla bugzilla/2.18.6
- version/mozilla bugzilla/2.20-rc1
- version/mozilla bugzilla/2.20
- version/mozilla bugzilla/2.19
- version/mozilla bugzilla/2.18-rc1
- version/mozilla bugzilla/2.20.5
- version/mozilla bugzilla/2.20.6
- version/mozilla bugzilla/2.22.3
- version/mozilla bugzilla/2.22.6
- version/mozilla bugzilla/2.17.4
- version/mozilla bugzilla/2.21.2
- version/mozilla bugzilla/2.17.1
- version/mozilla bugzilla/2.22.1
- version/mozilla bugzilla/2.20.1
- version/mozilla bugzilla/2.22.2
- version/mozilla bugzilla/2.18.1
- version/mozilla bugzilla/2.22-rc1
- version/mozilla bugzilla/2.22.5
- version/mozilla bugzilla/2.19.1
- version/mozilla bugzilla/2.17.5
- version/mozilla bugzilla/2.22
- version/mozilla bugzilla/2.17.3
- version/mozilla bugzilla/2.20.3
- version/mozilla bugzilla/2.18.4
- version/mozilla bugzilla/2.18
- version/mozilla bugzilla/2.18.3
- version/mozilla bugzilla/2.17.7
- version/mozilla bugzilla/2.20.7
- version/mozilla bugzilla/2.20.2
- version/mozilla bugzilla/2.20.4
- version/mozilla bugzilla/2.21.1
- version/mozilla bugzilla/2.18-rc3
- version/mozilla bugzilla/2.18.2
- version/mozilla bugzilla/2.18-rc2
- version/mozilla bugzilla/2.22.4
- version/mozilla bugzilla/2.21
- version/mozilla bugzilla/2.19.2
- version/mozilla bugzilla/3.4.3
- version/mozilla bugzilla/3.4.2
- version/mozilla bugzilla/3.4.9
- version/mozilla bugzilla/3.4.1
- version/mozilla bugzilla/3.4.10
- version/mozilla bugzilla/3.4.4
- version/mozilla bugzilla/3.4.8
- version/mozilla bugzilla/3.4.7
- version/mozilla bugzilla/3.4.11
- version/mozilla bugzilla/3.4
- version/mozilla bugzilla/3.4.5
- version/mozilla bugzilla/3.4-rc1
- version/mozilla bugzilla/3.4.6
- version/mozilla bugzilla/3.5.3
- version/mozilla bugzilla/3.5.2
- version/mozilla bugzilla/3.5.1
- version/mozilla bugzilla/3.5
- version/mozilla bugzilla/3.6.1
- version/mozilla bugzilla/3.6.0
- version/mozilla bugzilla/3.6.3
- version/mozilla bugzilla/3.6
- version/mozilla bugzilla/3.6.4
- version/mozilla bugzilla/3.6-rc1
- version/mozilla bugzilla/3.6.5
- version/mozilla bugzilla/3.6.2
- version/mozilla bugzilla/3.7.2
- version/mozilla bugzilla/3.7.1
- version/mozilla bugzilla/3.7
- version/mozilla bugzilla/3.7.3
- version/mozilla bugzilla/4.0.1
- version/mozilla bugzilla/4.0-rc2
- version/mozilla bugzilla/4.0-rc1
- version/mozilla bugzilla/4.0
- version/mozilla bugzilla/4.1.1
- version/mozilla bugzilla/4.1
- version/mozilla bugzilla/4.1.2
- version/mozilla bugzilla/3.0.4
- version/mozilla bugzilla/3.0-rc1
- version/mozilla bugzilla/3.1.3
- version/mozilla bugzilla/3.0.0
- version/mozilla bugzilla/3.3.2
- version/mozilla bugzilla/3.0.1
- version/mozilla bugzilla/3.2-rc1
- version/mozilla bugzilla/3.2.6
- version/mozilla bugzilla/3.1.1
- version/mozilla bugzilla/3.1.2
- version/mozilla bugzilla/3.2.5
- version/mozilla bugzilla/3.3.4
- version/mozilla bugzilla/3.2.9
- version/mozilla bugzilla/3.2.10
- version/mozilla bugzilla/3.2.3
- version/mozilla bugzilla/3.0
- version/mozilla bugzilla/3.0.11
- version/mozilla bugzilla/3.0.6
- version/mozilla bugzilla/3.0.7
- version/mozilla bugzilla/3.2.8
- version/mozilla bugzilla/3.1.4
- version/mozilla bugzilla/3.1.0
- version/mozilla bugzilla/3.0.3
- version/mozilla bugzilla/3.2
- version/mozilla bugzilla/3.0.9
- version/mozilla bugzilla/3.2.4
- version/mozilla bugzilla/3.0.2
- version/mozilla bugzilla/3.3.3
- version/mozilla bugzilla/3.2.2
- version/mozilla bugzilla/3.3
- version/mozilla bugzilla/3.0.10
- version/mozilla bugzilla/3.0.8
- version/mozilla bugzilla/3.2.7
- version/mozilla bugzilla/3.2-rc2
- version/mozilla bugzilla/3.0.5
- version/mozilla bugzilla/3.2.1
- version/mozilla bugzilla/3.3.1