This host is running Bugzilla and is prone to information disclosure vulnerability.

Successful exploitation will allows attackers to search for bugs that were reported by users belonging to one more groups. Impact Level: Application

Upgrade to Bugzilla version 3.2.8, 3.4.8, 3.6.2 or 3.7.3 For updates refer to http://www.bugzilla.org/download/

The flaw is due to an error in 'Search.pm' which allows remote attackers to determine the group memberships of arbitrary users via vectors involving the Search interface, boolean charts, and group-based pronouns.

Bugzilla 2.19.1 to 3.2.7, 3.3.1 to 3.4.7, 3.5.1 to 3.6.1 and 3.7 to 3.7.2

• http://secunia.com/advisories/41128
• http://www.vupen.com/english/advisories/2010/2035
• http://www.vupen.com/english/advisories/2010/2205
• https://bugzilla.mozilla.org/show_bug.cgi?id=417048

---

Updated on 2015-03-25