Debian: DSA-2322-1 Critical: Bugzilla Remote Threats Identified

Several vulnerabilities were discovered in Bugzilla, a web-based bug
tracking system.

CVE-2010-4572

By inserting particular strings into certain URLs, it was
possible to inject both headers and content to any
browser.

CVE-2010-4567, CVE-2011-0048

Bugzilla has a "URL" field that can contain several types
of URL, including "javascript:" and "data:" URLs. However,
it does not make "javascript:" and "data:" URLs into
clickable links, to protect against cross-site scripting
attacks or other attacks. It was possible to bypass this
protection by adding spaces into the URL in places that
Bugzilla did not expect them. Also, "javascript:" and
"data:" links were *always* shown as clickable to
logged-out users.

CVE-2010-4568

It was possible for a user to gain unauthorized access to
any Bugzilla account in a very short amount of time (short
enough that the attack is highly effective).

CVE-2011-0046

Various pages were vulnerable to Cross-Site Request
Forgery attacks. Most of these iss...