MGASA-2015-0048

    Dashboard / Vulnerabilities / MGASA-2015-0048

    MGASA-2015-0048

    Published: 31 Jan 2015Last Modified: 16 Apr 2026
    Upstream:
    CVE-2014-8630

    Summary: Updated bugzilla packages fix CVE-2014-8630

    Details: Updated bugzilla packages fix security vulnerability: Some code in Bugzilla does not properly utilize 3 arguments form for open() and it is possible for an account with editcomponents permissions to inject commands into product names and other attributes (CVE-2014-8630).

    References: https://advisories.mageia.org/MGASA-2015-0048.html, https://bugs.mageia.org/show_bug.cgi?id=15134, http://www.bugzilla.org/security/4.0.15/, http://www.bugzilla.org/releases/4.4.8/release-notes.html

    Affected packages

    Package

    Name: bugzilla

    Purl: pkg:rpm/mageia/bugzilla?arch=source&distro=mageia-4

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.4.8-1.mga4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High