Test ID:	1.3.6.1.4.1.25623.1.1.10.2014.0199
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2014-0199)
Summary:	The remote host is missing an update for the 'bugzilla' package(s) announced via the MGASA-2014-0199 advisory.
Description:	Summary: The remote host is missing an update for the 'bugzilla' package(s) announced via the MGASA-2014-0199 advisory. Vulnerability Insight: Updated bugzilla packages fix security vulnerabilities: Cross-site request forgery (CSRF) vulnerability in process_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that modify bugs via vectors involving a midair-collision token (CVE-2013-1733). Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11, 4.1.x and 4.2.x before 4.2.7, and 4.3.x and 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that commit an attachment change via an update action (CVE-2013-1734). Multiple cross-site scripting (XSS) vulnerabilities in editflagtypes.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11, 4.1.x and 4.2.x before 4.2.7, and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) sortkey parameter (CVE-2013-1742). Multiple cross-site scripting (XSS) vulnerabilities in report.cgi in Bugzilla 4.1.x and 4.2.x before 4.2.7 and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report, as demonstrated by the (1) summary or (2) real name field. NOTE: this issue exists because of an incomplete fix for CVE-2012-4189 (CVE-2013-1743). The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then submit a vulnerability report, related to a 'login CSRF' issue (CVE-2014-1517). Affected Software/OS: 'bugzilla' package(s) on Mageia 3. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1733 Common Vulnerability Exposure (CVE) ID: CVE-2013-1734 Common Vulnerability Exposure (CVE) ID: CVE-2013-1742 Common Vulnerability Exposure (CVE) ID: CVE-2013-1743 Common Vulnerability Exposure (CVE) ID: CVE-2014-1517 http://lists.fedoraproject.org/pipermail/package-announce/2014-April/132281.html http://lists.fedoraproject.org/pipermail/package-announce/2014-April/132309.html http://www.securitytracker.com/id/1030128
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.