Description
Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) page headers using the H1, H2, and H3 HTML tags in global/header.html.tmpl, (2) description fields of certain items in various edit cgi scripts, and (3) the id parameter in showdependencygraph.cgi.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | bugzilla | 2.16.7-7sarge2 | DSA-1208-1 |
Advisories 1
- DSA-1208-1 bugzilla Debian Security (DSA / DLA) · Mar 9, 2026
References
- bugzilla-h1h2-tags-xss(29610) vdb-entry
- 22409 third-party-advisory
- bugzilla-showdependencygraph(29619) vdb-entry
- 1760 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=355728
- DSA-1208 vendor-advisory
- ADV-2006-4035 vdb-entry
- 1017063 vdb-entry
- 29545 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=206037
- 20538 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=330555
- http://www.bugzilla.org/security/2.18.5/
- 22790 third-party-advisory
- 29544 vdb-entry
- GLSA-200611-04 vendor-advisory
- 20061015 Security Advisory for Bugzilla 2.18.5, 2.20.2, 2.22, and 2.23.2 mailing-list
- 22826 third-party-advisory
- 29549 vdb-entry