Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2, when PostgreSQL is used, does not properly handle large integers in (1) bug and (2) attachment phrases, which allows remote authenticated users to cause a denial of service (bug invisibility) via a crafted comment.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2, when PostgreSQL is used, does not properly handle large integers in (1) bug and (2) attachment phrases, which allows remote authenticated users to cause a denial of service (bug invisibility) via a crafted comment.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.vupen.com/english/advisories/2010/2035 | vdb-entry x_refsource_VUPEN |
| http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046534.html | vendor-advisory x_refsource_FEDORA |
| http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046518.html | vendor-advisory x_refsource_FEDORA |
| http://secunia.com/advisories/40892 | third-party-advisory x_refsource_SECUNIA |
| https://bugzilla.redhat.com/show_bug.cgi?id=623423 | x_refsource_CONFIRM |
| http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046546.html | vendor-advisory x_refsource_FEDORA |
| http://www.securityfocus.com/bid/42275 | vdb-entry x_refsource_BID |
| https://bugzilla.mozilla.org/show_bug.cgi?id=583690 | x_refsource_CONFIRM |
| http://www.bugzilla.org/security/3.2.7/ | x_refsource_CONFIRM |
| http://secunia.com/advisories/41128 | third-party-advisory x_refsource_SECUNIA |
| http://www.vupen.com/english/advisories/2010/2205 | vdb-entry x_refsource_VUPEN |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2, when PostgreSQL is used, does not properly handle large integers in (1) bug and (2) attachment phrases, which allows remote authenticated users to cause a denial of service (bug invisibility) via a crafted comment.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 4.0 | MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:P |
Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and other versions after 2.17.4 allows remote authenticated users to bypass moderation to approve and disapprove quips via a direct request to quips.cgi with the action parameter set to "approve."