Your submission was sent successfully! Close

CVE-2011-2978

Published: 09 August 2011

Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address (aka old_email field) for e-mail change notifications, which makes it easier for remote attackers to perform arbitrary address changes by leveraging an unattended workstation.

Priority

Medium

Status

Package Release Status
bugzilla
Launchpad, Ubuntu, Debian
Upstream
Released (3.4.12,3.6.6,4.0.2,4.1.3)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(dropped by debian)
Patches:
Vendor: http://www.debian.org/security/2011/dsa-2322