CVE-2012-4199: Infoleak

Q: What is the severity of CVE-2012-4199?

CVE-2012-4199 has a medium severity level as it exposes sensitive information through improper JavaScript function calls.

Q: How do I fix CVE-2012-4199?

To fix CVE-2012-4199, update Bugzilla to version 4.4rc1 or later, or 4.2.4 and 4.1.3 versions or later.

Q: What versions of Bugzilla are affected by CVE-2012-4199?

CVE-2012-4199 affects Bugzilla versions 3.x before 3.6.12, 3.7.x, 4.0.x before 4.0.9, 4.1.x, and 4.2.x before 4.2.4.

Q: What types of information can be exposed due to CVE-2012-4199?

CVE-2012-4199 can expose private product names or private component names through JavaScript function calls.

Q: Is CVE-2012-4199 a remote code execution vulnerability?

No, CVE-2012-4199 does not allow for remote code execution; it is primarily an information disclosure vulnerability.

Published Nov 16, 2012

Updated

template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates JavaScript function calls containing private product names or private component names in certain circumstances involving custom-field visibility control, which allows remote attackers to obtain sensitive information by reading HTML source code.

Affected Software

99 affected components

Bugzilla<=3.6.11

Bugzilla=3.0

Bugzilla=3.0-rc1

Bugzilla=3.0.0

Bugzilla=3.0.1

Bugzilla=3.0.2

Bugzilla=3.0.3

Bugzilla=3.0.4

Bugzilla=3.0.5

Bugzilla=3.0.6

Bugzilla=3.0.7

Bugzilla=3.0.8

Bugzilla=3.0.9

Bugzilla=3.0.10

Bugzilla=3.0.11

Bugzilla=3.1.0

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=3.1.3

Bugzilla=3.1.4

Bugzilla=3.2

Bugzilla=3.2-rc1

Bugzilla=3.2-rc2

Bugzilla=3.2.1

Bugzilla=3.2.2

Bugzilla=3.2.3

Bugzilla=3.2.4

Bugzilla=3.2.5

Bugzilla=3.2.6

Bugzilla=3.2.7

Bugzilla=3.2.8

Bugzilla=3.2.9

Bugzilla=3.2.10

Bugzilla=3.3

Bugzilla=3.3.1

Bugzilla=3.3.2

Bugzilla=3.3.3

Bugzilla=3.3.4

Bugzilla=3.4

Bugzilla=3.4-rc1

Bugzilla=3.4.1

Bugzilla=3.4.2

Bugzilla=3.4.3

Bugzilla=3.4.4

Bugzilla=3.4.5

Bugzilla=3.4.6

Bugzilla=3.4.7

Bugzilla=3.4.8

Bugzilla=3.4.9

Bugzilla=3.4.10

Bugzilla=3.4.11

Bugzilla=3.4.12

Bugzilla=3.4.13

Bugzilla=3.5

Bugzilla=3.5.1

Bugzilla=3.5.2

Bugzilla=3.5.3

Bugzilla=3.6

Bugzilla=3.6-rc1

Bugzilla=3.6.0

Bugzilla=3.6.1

Bugzilla=3.6.2

Bugzilla=3.6.3

Bugzilla=3.6.4

Bugzilla=3.6.5

Bugzilla=3.6.6

Bugzilla=3.6.7

Bugzilla=3.6.8

Bugzilla=3.6.9

Bugzilla=3.6.10

Bugzilla=3.7

Bugzilla=3.7.1

Bugzilla=3.7.2

Bugzilla=3.7.3

Bugzilla=4.0

Bugzilla=4.0-rc1

Bugzilla=4.0-rc2

Bugzilla=4.0.1

Bugzilla=4.0.2

Bugzilla=4.0.3

Bugzilla=4.0.4

Bugzilla=4.0.5

Bugzilla=4.0.6

Bugzilla=4.0.7

Bugzilla=4.0.8

Bugzilla=4.1

Bugzilla=4.1.1

Bugzilla=4.1.2

Bugzilla=4.1.3

Bugzilla=4.2

Bugzilla=4.2-rc1

Bugzilla=4.2-rc2

Bugzilla=4.2.1

Bugzilla=4.2.2

Bugzilla=4.2.3

Bugzilla=4.3

Bugzilla=4.3.1

Bugzilla=4.3.2

Bugzilla=4.3.3

Event History

Nov 16, 2012

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-4199?

CVE-2012-4199 has a medium severity level as it exposes sensitive information through improper JavaScript function calls.

How do I fix CVE-2012-4199?

To fix CVE-2012-4199, update Bugzilla to version 4.4rc1 or later, or 4.2.4 and 4.1.3 versions or later.

What versions of Bugzilla are affected by CVE-2012-4199?

CVE-2012-4199 affects Bugzilla versions 3.x before 3.6.12, 3.7.x, 4.0.x before 4.0.9, 4.1.x, and 4.2.x before 4.2.4.

What types of information can be exposed due to CVE-2012-4199?

CVE-2012-4199 can expose private product names or private component names through JavaScript function calls.

Is CVE-2012-4199 a remote code execution vulnerability?