CVE ID:	CVE-2014-1546
Description:	The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x before 4.4.5, and 4.5.x before 4.5.5 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with the _bz_callback character set.
Test IDs:	1.3.6.1.4.1.25623.1.1.10.2014.0349   1.3.6.1.4.1.25623.1.0.868050   1.3.6.1.4.1.25623.1.0.868064
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2014-1546 Bugtraq: 20140724 Security advisory for Bugzilla 4.5.5, 4.4.5, 4.2.10, and 4.0.14 (Google Search) http://www.securityfocus.com/archive/1/532895 http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136369.html http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136217.html http://www.mandriva.com/security/advisories?name=MDVSA-2014:169 http://www.securitytracker.com/id/1030648