Bugzilla is prone to the following vulnerabilities: 1. A security-bypass issue. 2. Multiple cross-site scripting vulnerabilities. 3. Multiple cross-site request-forgery vulnerabilities. Successfully exploiting these issues may allow an attacker to bypass certain security restrictions, execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials or perform certain administrative actions and perform actions in the vulnerable application in the context of the victim. The following versions are vulnerable: 3.1.x versions prior to 3.2.10 3.2.x versions prior to 3.4.10 3.3.x versions prior to 3.6.4 4.x versions prior to 4.0rc2

Vendor updates are available. Please see the references for more information.

• http://www.bugzilla.org/security/3.2.9/
• https://www.securityfocus.com/bid/45982

---

Updated on 2015-03-25