CVE-2015-8509: Infoleak

Published Jan 3, 2016

Updated

Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files, which allows remote attackers to obtain sensitive information by leveraging a web browser that interprets CSV data as JavaScript code.

Affected Software

147 affected components

Bugzilla=2.0

Bugzilla=2.2

Bugzilla=2.4

Bugzilla=2.6

Bugzilla=2.8

Bugzilla=2.10

Bugzilla=2.12

Bugzilla=2.14

Bugzilla=2.14.1

Bugzilla=2.14.2

Bugzilla=2.14.3

Bugzilla=2.14.4

Bugzilla=2.14.5

Bugzilla=2.16

Bugzilla=2.16.1

Bugzilla=2.16.2

Bugzilla=2.16.3

Bugzilla=2.16.4

Bugzilla=2.16.5

Bugzilla=2.16.6

Bugzilla=2.16.7

Bugzilla=2.16.8

Bugzilla=2.16.9

Bugzilla=2.16.10

Bugzilla=2.16.11

Bugzilla=2.18

Bugzilla=2.18.1

Bugzilla=2.18.2

Bugzilla=2.18.3

Bugzilla=2.18.4

Bugzilla=2.18.5

Bugzilla=2.18.6

Bugzilla=2.20

Bugzilla=2.20.1

Bugzilla=2.20.2

Bugzilla=2.20.3

Bugzilla=2.20.4

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.20.7

Bugzilla=2.22

Bugzilla=2.22.1

Bugzilla=2.22.2

Bugzilla=2.22.3

Bugzilla=2.22.4

Bugzilla=2.22.5

Bugzilla=2.22.6

Bugzilla=2.22.7

Bugzilla=3.0

Bugzilla=3.0.1

Bugzilla=3.0.2

Bugzilla=3.0.3

Bugzilla=3.0.4

Bugzilla=3.0.5

Bugzilla=3.0.6

Bugzilla=3.0.7

Bugzilla=3.0.8

Bugzilla=3.0.9

Bugzilla=3.0.10

Bugzilla=3.0.11

Bugzilla=3.2

Bugzilla=3.2.1

Bugzilla=3.2.2

Bugzilla=3.2.3

Bugzilla=3.2.4

Bugzilla=3.2.5

Bugzilla=3.2.6

Bugzilla=3.2.7

Bugzilla=3.2.8

Bugzilla=3.2.9

Bugzilla=3.2.10

Bugzilla=3.4

Bugzilla=3.4.1

Bugzilla=3.4.2

Bugzilla=3.4.3

Bugzilla=3.4.5

Bugzilla=3.4.6

Bugzilla=3.4.7

Bugzilla=3.4.8

Bugzilla=3.4.9

Bugzilla=3.4.10

Bugzilla=3.4.11

Bugzilla=3.4.12

Bugzilla=3.4.13

Bugzilla=3.4.14

Bugzilla=3.6

Bugzilla=3.6.1

Bugzilla=3.6.2

Bugzilla=3.6.3

Bugzilla=3.6.4

Bugzilla=3.6.5

Bugzilla=3.6.6

Bugzilla=3.6.7

Bugzilla=3.6.8

Bugzilla=3.6.9

Bugzilla=3.6.10

Bugzilla=3.6.11

Bugzilla=3.6.12

Bugzilla=3.6.13

Bugzilla=4.0

Bugzilla=4.0.1

Bugzilla=4.0.2

Bugzilla=4.0.3

Bugzilla=4.0.4

Bugzilla=4.0.5

Bugzilla=4.0.6

Bugzilla=4.0.7

Bugzilla=4.0.8

Bugzilla=4.0.9

Bugzilla=4.0.10

Bugzilla=4.0.11

Bugzilla=4.0.12

Bugzilla=4.0.13

Bugzilla=4.0.14

Bugzilla=4.0.15

Bugzilla=4.0.16

Bugzilla=4.0.17

Bugzilla=4.0.18

Bugzilla=4.2

Bugzilla=4.2.1

Bugzilla=4.2.2

Bugzilla=4.2.3

Bugzilla=4.2.4

Bugzilla=4.2.5

Bugzilla=4.2.6

Bugzilla=4.2.7

Bugzilla=4.2.8

Bugzilla=4.2.9

Bugzilla=4.2.10

Bugzilla=4.2.11

Bugzilla=4.2.12

Bugzilla=4.2.13

Bugzilla=4.2.14

Bugzilla=4.2.15

Bugzilla=4.4

Bugzilla=4.4.1

Bugzilla=4.4.2

Bugzilla=4.4.3

Bugzilla=4.4.4

Bugzilla=4.4.5

Bugzilla=4.4.6

Bugzilla=4.4.7

Bugzilla=4.4.8

Bugzilla=4.4.9

Bugzilla=4.4.10

Bugzilla=5.0

Bugzilla=5.0.1

Event History

Jan 3, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-8509?

CVE-2015-8509 is classified as a moderate severity vulnerability due to the potential for information leakage.

How do I fix CVE-2015-8509?

You can fix CVE-2015-8509 by upgrading to Bugzilla version 4.2.16, 4.4.11, or 5.0.2 or later.

Who is affected by CVE-2015-8509?

CVE-2015-8509 affects Bugzilla versions 2.x, 3.x, and certain 4.x and 5.x versions prior to their respective fixes.

What type of vulnerability is CVE-2015-8509?

CVE-2015-8509 is a vulnerability that allows remote attackers to obtain sensitive information through improper construction of CSV files.

Can CVE-2015-8509 lead to XSS attacks?

CVE-2015-8509 can potentially lead to XSS attacks as it allows CSV data to be interpreted as JavaScript code by web browsers.

CVE-2015-8509: Infoleak

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2015-8509?

How do I fix CVE-2015-8509?

Who is affected by CVE-2015-8509?

What type of vulnerability is CVE-2015-8509?

Can CVE-2015-8509 lead to XSS attacks?

Company

Resources

Contact