CVE-2012-4197: Infoleak

Q: What is the severity of CVE-2012-4197?

The severity of CVE-2012-4197 is classified as medium, as it allows remote attackers to access private bug attachment descriptions.

Q: How do I fix CVE-2012-4197?

To fix CVE-2012-4197, update your Bugzilla installation to version 3.6.12 or later, or 4.0.9 or later.

Q: Which Bugzilla versions are affected by CVE-2012-4197?

CVE-2012-4197 affects Bugzilla versions 2.x and 3.x before 3.6.12, and 4.x before 4.0.9, 4.2.4, and 4.4rc1.

Q: Can private bug descriptions be exposed due to CVE-2012-4197?

Yes, CVE-2012-4197 allows attackers to read attachment descriptions of private bugs.

Q: Is my Bugzilla installation vulnerable if it runs an older version?

Yes, if your Bugzilla installation runs an older version prior to the fixed releases, it is vulnerable to CVE-2012-4197.

Published Nov 16, 2012

Updated

Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 allows remote attackers to read attachment descriptions from private bugs via an obsolete=1 insert action.

Affected Software

181 affected components

Bugzilla=2.0

Bugzilla=2.2

Bugzilla=2.4

Bugzilla=2.6

Bugzilla=2.8

Bugzilla=2.9

Bugzilla=2.10

Bugzilla=2.12

Bugzilla=2.14

Bugzilla=2.14.1

Bugzilla=2.14.2

Bugzilla=2.14.3

Bugzilla=2.14.4

Bugzilla=2.14.5

Bugzilla=2.16

Bugzilla=2.16-rc1

Bugzilla=2.16-rc2

Bugzilla=2.16.1

Bugzilla=2.16.2

Bugzilla=2.16.3

Bugzilla=2.16.4

Bugzilla=2.16.5

Bugzilla=2.16.6

Bugzilla=2.16.7

Bugzilla=2.16.8

Bugzilla=2.16.9

Bugzilla=2.16.10

Bugzilla=2.16.11

Bugzilla=2.17

Bugzilla=2.17.1

Bugzilla=2.17.2

Bugzilla=2.17.3

Bugzilla=2.17.4

Bugzilla=2.17.5

Bugzilla=2.17.6

Bugzilla=2.17.7

Bugzilla=2.18

Bugzilla=2.18-rc1

Bugzilla=2.18-rc2

Bugzilla=2.18-rc3

Bugzilla=2.18.1

Bugzilla=2.18.2

Bugzilla=2.18.3

Bugzilla=2.18.4

Bugzilla=2.18.5

Bugzilla=2.18.6

Bugzilla=2.18.6\+

Bugzilla=2.18.7

Bugzilla=2.18.8

Bugzilla=2.18.9

Bugzilla=2.19

Bugzilla=2.19.1

Bugzilla=2.19.2

Bugzilla=2.19.3

Bugzilla=2.20

Bugzilla=2.20-rc1

Bugzilla=2.20-rc2

Bugzilla=2.20.1

Bugzilla=2.20.2

Bugzilla=2.20.3

Bugzilla=2.20.4

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.20.7

Bugzilla=2.21

Bugzilla=2.21.1

Bugzilla=2.21.2

Bugzilla=2.21.2-rc1

Bugzilla=2.22

Bugzilla=2.22-rc1

Bugzilla=2.22.1

Bugzilla=2.22.2

Bugzilla=2.22.3

Bugzilla=2.22.4

Bugzilla=2.22.5

Bugzilla=2.22.6

Bugzilla=2.22.7

Bugzilla=2.23

Bugzilla=2.23.1

Bugzilla=2.23.2

Bugzilla=2.23.3

Bugzilla=2.23.4

Bugzilla<=3.6.11

Bugzilla=3.0

Bugzilla=3.0-rc1

Bugzilla=3.0.0

Bugzilla=3.0.1

Bugzilla=3.0.2

Bugzilla=3.0.3

Bugzilla=3.0.4

Bugzilla=3.0.5

Bugzilla=3.0.6

Bugzilla=3.0.7

Bugzilla=3.0.8

Bugzilla=3.0.9

Bugzilla=3.0.10

Bugzilla=3.0.11

Bugzilla=3.1.0

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=3.1.3

Bugzilla=3.1.4

Bugzilla=3.2

Bugzilla=3.2-rc1

Bugzilla=3.2-rc2

Bugzilla=3.2.1

Bugzilla=3.2.2

Bugzilla=3.2.3

Bugzilla=3.2.4

Bugzilla=3.2.5

Bugzilla=3.2.6

Bugzilla=3.2.7

Bugzilla=3.2.8

Bugzilla=3.2.9

Bugzilla=3.2.10

Bugzilla=3.3

Bugzilla=3.3.1

Bugzilla=3.3.2

Bugzilla=3.3.3

Bugzilla=3.3.4

Bugzilla=3.4

Bugzilla=3.4-rc1

Bugzilla=3.4.1

Bugzilla=3.4.2

Bugzilla=3.4.3

Bugzilla=3.4.4

Bugzilla=3.4.5

Bugzilla=3.4.6

Bugzilla=3.4.7

Bugzilla=3.4.8

Bugzilla=3.4.9

Bugzilla=3.4.10

Bugzilla=3.4.11

Bugzilla=3.4.12

Bugzilla=3.4.13

Bugzilla=3.5

Bugzilla=3.5.1

Bugzilla=3.5.2

Bugzilla=3.5.3

Bugzilla=3.6

Bugzilla=3.6-rc1

Bugzilla=3.6.0

Bugzilla=3.6.1

Bugzilla=3.6.2

Bugzilla=3.6.3

Bugzilla=3.6.4

Bugzilla=3.6.5

Bugzilla=3.6.6

Bugzilla=3.6.7

Bugzilla=3.6.8

Bugzilla=3.6.9

Bugzilla=3.6.10

Bugzilla=3.7

Bugzilla=3.7.1

Bugzilla=3.7.2

Bugzilla=3.7.3

Bugzilla=4.0

Bugzilla=4.0-rc1

Bugzilla=4.0-rc2

Bugzilla=4.0.1

Bugzilla=4.0.2

Bugzilla=4.0.3

Bugzilla=4.0.4

Bugzilla=4.0.5

Bugzilla=4.0.6

Bugzilla=4.0.7

Bugzilla=4.0.8

Bugzilla=4.1

Bugzilla=4.1.1

Bugzilla=4.1.2

Bugzilla=4.1.3

Bugzilla=4.2

Bugzilla=4.2-rc1

Bugzilla=4.2-rc2

Bugzilla=4.2.1

Bugzilla=4.2.2

Bugzilla=4.2.3

Bugzilla=4.3

Bugzilla=4.3.1

Bugzilla=4.3.2

Bugzilla=4.3.3

Remediation

Patch Available

https://bugzilla.mozilla.org/show_bug.cgi?id=802204

Event History

Nov 16, 2012

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-4197?

The severity of CVE-2012-4197 is classified as medium, as it allows remote attackers to access private bug attachment descriptions.

How do I fix CVE-2012-4197?

To fix CVE-2012-4197, update your Bugzilla installation to version 3.6.12 or later, or 4.0.9 or later.

Which Bugzilla versions are affected by CVE-2012-4197?