Description
Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 allows remote attackers to determine the group memberships of arbitrary users via vectors involving the Search interface, boolean charts, and group-based pronouns.
References
- ADV-2010-2035 vdb-entry
- FEDORA-2010-13072 vendor-advisory
- FEDORA-2010-13171 vendor-advisory
- 40892 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=623423
- FEDORA-2010-13086 vendor-advisory
- 42275 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=417048
- http://www.bugzilla.org/security/3.2.7/
- 41128 third-party-advisory
- ADV-2010-2205 vdb-entry