CVE-2011-2381: Code Injection

Published Aug 9, 2011

Updated

CRLF injection vulnerability in Bugzilla 2.17.1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to inject arbitrary e-mail headers via an attachment description in a flagmail notification.

Affected Software

115 affected components

Bugzilla=2.22.7

Bugzilla=2.17.6

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.20-rc1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.21.2

Bugzilla=2.17.1

Bugzilla=2.22.1

Bugzilla=2.20.1

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.22.5

Bugzilla=2.19.1

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=2.17.3

Bugzilla=2.20.3

Bugzilla=2.18.4

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.7

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=2.19.2

Bugzilla=3.4.3

Bugzilla=3.4.2

Bugzilla=3.4.9

Bugzilla=3.4.1

Bugzilla=3.4.10

Bugzilla=3.4.4

Bugzilla=3.4.8

Bugzilla=3.4.7

Bugzilla=3.4.11

Bugzilla=3.4

Bugzilla=3.4.5

Bugzilla=3.4-rc1

Bugzilla=3.4.6

Bugzilla=3.5.3

Bugzilla=3.5.2

Bugzilla=3.5.1

Bugzilla=3.5

Bugzilla=3.6.1

Bugzilla=3.6.0

Bugzilla=3.6.3

Bugzilla=3.6

Bugzilla=3.6.4

Bugzilla=3.6-rc1

Bugzilla=3.6.5

Bugzilla=3.6.2

Bugzilla=3.7.2

Bugzilla=3.7.1

Bugzilla=3.7

Bugzilla=3.7.3

Bugzilla=4.0.1

Bugzilla=4.0-rc2

Bugzilla=4.0-rc1

Bugzilla=4.0

Bugzilla=4.1.1

Bugzilla=4.1

Bugzilla=4.1.2

Bugzilla=3.0.4

Bugzilla=3.0-rc1

Bugzilla=3.1.3

Bugzilla=3.0.0

Bugzilla=3.3.2

Bugzilla=3.0.1

Bugzilla=3.2-rc1

Bugzilla=3.2.6

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=3.2.5

Bugzilla=3.3.4

Bugzilla=3.2.9

Bugzilla=3.2.10

Bugzilla=3.2.3

Bugzilla=3.0

Bugzilla=3.0.11

Bugzilla=3.0.6

Bugzilla=3.0.7

Bugzilla=3.2.8

Bugzilla=3.1.4

Bugzilla=3.1.0

Bugzilla=3.0.3

Bugzilla=3.2

Bugzilla=3.0.9

Bugzilla=3.2.4

Bugzilla=3.0.2

Bugzilla=3.3.3

Bugzilla=3.2.2

Bugzilla=3.3

Bugzilla=3.0.10

Bugzilla=3.0.8

Bugzilla=3.2.7

Bugzilla=3.2-rc2

Bugzilla=3.0.5

Bugzilla=3.2.1

Bugzilla=3.3.1

Remediation

Patch Available

https://bugzilla.mozilla.org/show_bug.cgi?id=657158

Event History

Aug 9, 2011

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-2381?

CVE-2011-2381 is classified as a moderate severity vulnerability, allowing for potential exploitation through CRLF injection.

What versions of Bugzilla are affected by CVE-2011-2381?

CVE-2011-2381 affects Bugzilla versions 2.17.1 through 2.22.7, and multiple versions up to and including 4.0.x before 4.0.2 and 4.1.x before 4.1.3.

How do I fix CVE-2011-2381?

To fix CVE-2011-2381, upgrade Bugzilla to version 4.1.3 or later.

What type of attack does CVE-2011-2381 facilitate?

CVE-2011-2381 allows remote attackers to inject arbitrary e-mail headers via an attachment description.

Is there a known exploit for CVE-2011-2381?

There are no public exploits specifically targeting CVE-2011-2381, but the vulnerability can be leveraged for email header injection attacks.