Description
The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | bugzilla | 2.14.2-0woody4 | DSA-230 |
Advisories 1
- DSA-230 bugzilla - insecure permissions, spurious backup files Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2003:012 vendor-advisory
- 6502 vdb-entry
- 20030102 [BUGZILLA] Security Advisory - remote database password disclosure mailing-list
- DSA-230 vendor-advisory
- bugzilla-mining-world-writable(10971) vdb-entry