Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-8630

Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.

Published

2015-02-01T15:59:04.353

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-77

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	bugzilla	≤ 4.0.16	Yes
Application	mozilla	bugzilla	4.1	Yes
Application	mozilla	bugzilla	4.1.1	Yes
Application	mozilla	bugzilla	4.1.2	Yes
Application	mozilla	bugzilla	4.1.3	Yes
Application	mozilla	bugzilla	4.2	Yes
Application	mozilla	bugzilla	4.2	Yes
Application	mozilla	bugzilla	4.2	Yes
Application	mozilla	bugzilla	4.2.1	Yes
Application	mozilla	bugzilla	4.2.2	Yes
Application	mozilla	bugzilla	4.2.3	Yes
Application	mozilla	bugzilla	4.2.4	Yes
Application	mozilla	bugzilla	4.2.5	Yes
Application	mozilla	bugzilla	4.2.6	Yes
Application	mozilla	bugzilla	4.2.7	Yes
Application	mozilla	bugzilla	4.2.8	Yes
Application	mozilla	bugzilla	4.2.9	Yes
Application	mozilla	bugzilla	4.2.10	Yes
Application	mozilla	bugzilla	4.2.11	Yes
Application	mozilla	bugzilla	4.3	Yes
Application	mozilla	bugzilla	4.3.1	Yes
Application	mozilla	bugzilla	4.3.2	Yes
Application	mozilla	bugzilla	4.3.3	Yes
Application	mozilla	bugzilla	4.4	Yes
Application	mozilla	bugzilla	4.4	Yes
Application	mozilla	bugzilla	4.4	Yes
Application	mozilla	bugzilla	4.4.1	Yes
Application	mozilla	bugzilla	4.4.2	Yes
Application	mozilla	bugzilla	4.4.3	Yes
Application	mozilla	bugzilla	4.4.4	Yes
Application	mozilla	bugzilla	4.4.5	Yes
Application	mozilla	bugzilla	4.4.6	Yes
Application	mozilla	bugzilla	4.5	Yes
Application	mozilla	bugzilla	4.5.1	Yes
Application	mozilla	bugzilla	4.5.2	Yes
Application	mozilla	bugzilla	4.5.3	Yes
Application	mozilla	bugzilla	4.5.4	Yes
Application	mozilla	bugzilla	4.5.5	Yes
Application	mozilla	bugzilla	4.5.6	Yes
Operating System	fedoraproject	fedora	20	Yes
Operating System	fedoraproject	fedora	21	Yes

References

http://advisories.mageia.org/MGASA-2015-0048.html ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149921.html Third Party Advisory ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149925.html Third Party Advisory ([email protected])
http://www.bugzilla.org/security/4.0.15/ Issue Tracking, Patch, Vendor Advisory ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2015:030 ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=1079065 Issue Tracking, Vendor Advisory ([email protected])
https://security.gentoo.org/glsa/201607-11 ([email protected])
http://advisories.mageia.org/MGASA-2015-0048.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149921.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149925.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.bugzilla.org/security/4.0.15/ Issue Tracking, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2015:030 (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.mozilla.org/show_bug.cgi?id=1079065 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/201607-11 (af854a3a-2127-422b-91ae-364da2661108)