Bugzilla is prone to the following vulnerabilities: 1. A security-bypass vulnerability. 2. An email header-injection vulnerability. 3. Multiple information-disclosure vulnerabilities. 4. Multiple cross-site scripting vulnerabilities. Successfully exploiting these issues may allow an attacker to bypass certain security restrictions, obtain sensitive information, execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and perform actions in the vulnerable application in the context of the victim.

Vendor updates are available. Please see the references for more information.

• http://www.bugzilla.org
• http://www.bugzilla.org/security/3.4.11/
• http://www.securityfocus.com/bid/49042

---

Updated on 2015-03-25