CVE-2014-1571: Infoleak

Published Oct 13, 2014

Updated

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, related to Bug.pm, Flag.pm, and a mail template.

Affected Software

207 affected components

Bugzilla=2.0

Bugzilla=2.2

Bugzilla=2.4

Bugzilla=2.6

Bugzilla=2.8

Bugzilla=2.9

Bugzilla=2.10

Bugzilla=2.12

Bugzilla=2.14

Bugzilla=2.14.1

Bugzilla=2.14.2

Bugzilla=2.14.3

Bugzilla=2.14.4

Bugzilla=2.14.5

Bugzilla=2.16

Bugzilla=2.16-rc1

Bugzilla=2.16-rc2

Bugzilla=2.16.1

Bugzilla=2.16.2

Bugzilla=2.16.3

Bugzilla=2.16.4

Bugzilla=2.16.5

Bugzilla=2.16.6

Bugzilla=2.16.7

Bugzilla=2.16.8

Bugzilla=2.16.9

Bugzilla=2.16.10

Bugzilla=2.16.11

Bugzilla=2.16_rc2

Bugzilla=2.17

Bugzilla=2.17.1

Bugzilla=2.17.2

Bugzilla=2.17.3

Bugzilla=2.17.4

Bugzilla=2.17.5

Bugzilla=2.17.6

Bugzilla=2.17.7

Bugzilla=2.18

Bugzilla=2.18-rc1

Bugzilla=2.18-rc2

Bugzilla=2.18-rc3

Bugzilla=2.18.1

Bugzilla=2.18.2

Bugzilla=2.18.3

Bugzilla=2.18.4

Bugzilla=2.18.5

Bugzilla=2.18.6

Bugzilla=2.18.6\+

Bugzilla=2.18.7

Bugzilla=2.18.8

Bugzilla=2.18.9

Bugzilla=2.19

Bugzilla=2.19.1

Bugzilla=2.19.2

Bugzilla=2.19.3

Bugzilla=2.20

Bugzilla=2.20-rc1

Bugzilla=2.20-rc2

Bugzilla=2.20.1

Bugzilla=2.20.2

Bugzilla=2.20.3

Bugzilla=2.20.4

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.20.7

Bugzilla=2.21

Bugzilla=2.21.1

Bugzilla=2.21.2

Bugzilla=2.21.2-rc1

Bugzilla=2.22

Bugzilla=2.22-rc1

Bugzilla=2.22.1

Bugzilla=2.22.2

Bugzilla=2.22.3

Bugzilla=2.22.4

Bugzilla=2.22.5

Bugzilla=2.22.6

Bugzilla=2.22.7

Bugzilla=2.23

Bugzilla=2.23.1

Bugzilla=2.23.2

Bugzilla=2.23.3

Bugzilla=2.23.4

Bugzilla=3.0

Bugzilla=3.0-rc1

Bugzilla=3.0.0

Bugzilla=3.0.1

Bugzilla=3.0.2

Bugzilla=3.0.3

Bugzilla=3.0.4

Bugzilla=3.0.5

Bugzilla=3.0.6

Bugzilla=3.0.7

Bugzilla=3.0.8

Bugzilla=3.0.9

Bugzilla=3.0.10

Bugzilla=3.0.11

Bugzilla=3.0_rc1

Bugzilla=3.1.0

Bugzilla=3.1.1

Bugzilla=3.1.2

Bugzilla=3.1.3

Bugzilla=3.1.4

Bugzilla=3.2

Bugzilla=3.2-rc1

Bugzilla=3.2-rc2

Bugzilla=3.2.1

Bugzilla=3.2.2

Bugzilla=3.2.3

Bugzilla=3.2.4

Bugzilla=3.2.5

Bugzilla=3.2.6

Bugzilla=3.2.7

Bugzilla=3.2.8

Bugzilla=3.2.9

Bugzilla=3.2.10

Bugzilla=3.3

Bugzilla=3.3.1

Bugzilla=3.3.2

Bugzilla=3.3.3

Bugzilla=3.3.4

Bugzilla=3.4

Bugzilla=3.4-rc1

Bugzilla=3.4.1

Bugzilla=3.4.2

Bugzilla=3.4.3

Bugzilla=3.4.4

Bugzilla=3.4.5

Bugzilla=3.4.6

Bugzilla=3.4.7

Bugzilla=3.4.8

Bugzilla=3.4.9

Bugzilla=3.4.10

Bugzilla=3.4.11

Bugzilla=3.4.12

Bugzilla=3.4.13

Bugzilla=3.5

Bugzilla=3.5.1

Bugzilla=3.5.2

Bugzilla=3.5.3

Bugzilla=3.6

Bugzilla=3.6-rc1

Bugzilla=3.6.0

Bugzilla=3.6.1

Bugzilla=3.6.2

Bugzilla=3.6.3

Bugzilla=3.6.4

Bugzilla=3.6.5

Bugzilla=3.6.6

Bugzilla=3.6.7

Bugzilla=3.6.8

Bugzilla=3.6.9

Bugzilla=3.6.10

Bugzilla=3.6.11

Bugzilla=3.6.12

Bugzilla=3.6.13

Bugzilla=3.7

Bugzilla=3.7.1

Bugzilla=3.7.2

Bugzilla=3.7.3

Bugzilla=4.0

Bugzilla=4.0-rc1

Bugzilla=4.0-rc2

Bugzilla=4.0.1

Bugzilla=4.0.10

Bugzilla=4.0.11

Bugzilla=4.0.12

Bugzilla=4.0.13

Bugzilla=4.0.14

Bugzilla=4.1

Bugzilla=4.1.1

Bugzilla=4.1.2

Bugzilla=4.1.3

Bugzilla=4.2

Bugzilla=4.2-rc1

Bugzilla=4.2-rc2

Bugzilla=4.2.1

Bugzilla=4.2.2

Bugzilla=4.2.3

Bugzilla=4.2.4

Bugzilla=4.2.5

Bugzilla=4.2.6

Bugzilla=4.2.7

Bugzilla=4.2.8

Bugzilla=4.2.9

Bugzilla=4.2.10

Bugzilla=4.3

Bugzilla=4.3.1

Bugzilla=4.3.2

Bugzilla=4.3.3

Bugzilla=4.4

Bugzilla=4.4-rc1

Bugzilla=4.4-rc2

Bugzilla=4.4.1

Bugzilla=4.4.2

Bugzilla=4.4.3

Bugzilla=4.4.4

Bugzilla=4.4.5

Bugzilla=4.5

Bugzilla=4.5.1

Bugzilla=4.5.2

Bugzilla=4.5.3

Bugzilla=4.5.4

Bugzilla=4.5.5

fedoraproject fedora=19

fedoraproject fedora=20

fedoraproject fedora=21

Remediation

Patch Available

https://bugzilla.mozilla.org/show_bug.cgi?id=1064140

Event History

Oct 13, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-1571?

CVE-2014-1571 is classified as a medium severity vulnerability.

How do I fix CVE-2014-1571?

To fix CVE-2014-1571, update Bugzilla to version 4.0.15 or later, 4.2.11 or later, 4.4.6 or later, or 4.5.6 or later.

What versions of Bugzilla are affected by CVE-2014-1571?

Bugzilla versions 2.x through 4.0.x, 4.1.x, 4.2.x, 4.3.x, 4.4.x, and 4.5.x are affected by CVE-2014-1571.

What type of attack does CVE-2014-1571 enable?

CVE-2014-1571 allows remote authenticated users to obtain sensitive private-comment information.

Which components of Bugzilla are related to CVE-2014-1571?

CVE-2014-1571 is related to the Bug.pm and Flag.pm components, as well as a mail template.