Description
Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address (aka old_email field) for e-mail change notifications, which makes it easier for remote attackers to perform arbitrary address changes by leveraging an unattended workstation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | bugzilla | 3.6.2.0-4.4 | DSA-2322-1 |
Advisories 1
- DSA-2322-1 bugzilla - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 74301 vdb-entry
- 45501 third-party-advisory
- bugzilla-account-sec-bypass(69036) vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=670868
- http://www.bugzilla.org/security/3.4.11/
- DSA-2322 vendor-advisory
- 49042 vdb-entry