Debian
bugzilla package

  1. Bug #281915
  2. Comment #10

Comment 10 for bug 281915

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package bugzilla - 3.0.4.1-2ubuntu1.1

---------------
bugzilla (3.0.4.1-2ubuntu1.1) intrepid-security; urgency=low

  * SECURITY UPDATE: Directory traversal vulnerability in importxml.pl in
    Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attach_path
    is enabled, allows remote attackers to read arbitrary files via an
    XML file with a .. (dot dot) in the data element.(LP: #281915)
    - debian/maintenance/33_CVE-2008-4437.sh: upstream patch with regex
      to remove any leading path data from the filename.
    - CVE-2008-4437

 -- Stefan Lesicnik <email address hidden> Mon, 13 Oct 2008 11:52:24 +0200