Description
Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote attackers to obtain (1) the description of arbitrary attachments by viewing the attachment in "diff" mode in attachment.cgi, and (2) the deadline field by viewing the XML format of the bug in show_bug.cgi.
References
- 22409 third-party-advisory
- 1760 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=346564
- 1017064 vdb-entry
- ADV-2006-4035 vdb-entry
- 29546 vdb-entry
- 20538 vdb-entry
- http://www.bugzilla.org/security/2.18.5/
- 22790 third-party-advisory
- 29547 vdb-entry
- GLSA-200611-04 vendor-advisory
- 20061015 Security Advisory for Bugzilla 2.18.5, 2.20.2, 2.22, and 2.23.2 mailing-list
- https://bugzilla.mozilla.org/show_bug.cgi?id=346086