CVE-2014-8630 Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcompone...
MediumCVSS 6.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla bugzilla | <= 4.0.16 | No fix listed |
| mozilla bugzilla | = 4.1 | No fix listed |
| mozilla bugzilla | = 4.1.1 | No fix listed |
| mozilla bugzilla | = 4.1.2 | No fix listed |
| mozilla bugzilla | = 4.1.3 | No fix listed |
| mozilla bugzilla | = 4.2 | No fix listed |
| mozilla bugzilla | = 4.2-rc1 | No fix listed |
| mozilla bugzilla | = 4.2-rc2 | No fix listed |
| mozilla bugzilla | = 4.2.1 | No fix listed |
| mozilla bugzilla | = 4.2.2 | No fix listed |
| mozilla bugzilla | = 4.2.3 | No fix listed |
| mozilla bugzilla | = 4.2.4 | No fix listed |
| mozilla bugzilla | = 4.2.5 | No fix listed |
| mozilla bugzilla | = 4.2.6 | No fix listed |
| mozilla bugzilla | = 4.2.7 | No fix listed |
| mozilla bugzilla | = 4.2.8 | No fix listed |
| mozilla bugzilla | = 4.2.9 | No fix listed |
| mozilla bugzilla | = 4.2.10 | No fix listed |
| mozilla bugzilla | = 4.2.11 | No fix listed |
| mozilla bugzilla | = 4.3 | No fix listed |
| mozilla bugzilla | = 4.3.1 | No fix listed |
| mozilla bugzilla | = 4.3.2 | No fix listed |
| mozilla bugzilla | = 4.3.3 | No fix listed |
| mozilla bugzilla | = 4.4 | No fix listed |
| mozilla bugzilla | = 4.4-rc1 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla bugzilla | = 4.4-rc2 | No fix listed |
| mozilla bugzilla | = 4.4.1 | No fix listed |
| mozilla bugzilla | = 4.4.2 | No fix listed |
| mozilla bugzilla | = 4.4.3 | No fix listed |
| mozilla bugzilla | = 4.4.4 | No fix listed |
| mozilla bugzilla | = 4.4.5 | No fix listed |
| mozilla bugzilla | = 4.4.6 | No fix listed |
| mozilla bugzilla | = 4.5 | No fix listed |
| mozilla bugzilla | = 4.5.1 | No fix listed |
| mozilla bugzilla | = 4.5.2 | No fix listed |
| mozilla bugzilla | = 4.5.3 | No fix listed |
| mozilla bugzilla | = 4.5.4 | No fix listed |
| mozilla bugzilla | = 4.5.5 | No fix listed |
| mozilla bugzilla | = 4.5.6 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
References
- advisories.mageia.org
- FEDORA-2015-1713 third-party-advisory vendor-advisory
- FEDORA-2015-1699 third-party-advisory vendor-advisory
- www.bugzilla.org issue-tracking patch vendor-advisory
- MDVSA-2015:030 vendor-advisory
- bugzilla.mozilla.org issue-tracking vendor-advisory
- GLSA-201607-11 vendor-advisory