‘Moderately Critical’ Bugzilla Bugs Squashed

thumbnail ‘Moderately Critical’ Bugzilla Bugs Squashed

Multiple security flaws in Bugzilla could put users of the software defect tracking software at risk of cross-site scripting, data manipulation and data exposure attacks. According to a warning from the open-source Bugzilla project, users should immediately upgrade to versions 2.18.6, 2.20.3, 2.22.1 or 2.23.3 to minimize the risk of malicious attacks. Security alerts aggregator […]

Written By: Ryan Naraine
Oct 16, 2006
Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

Multiple security flaws in Bugzilla could put users of the software defect tracking software at risk of cross-site scripting, data manipulation and data exposure attacks.

According to a warning from the open-source Bugzilla project, users should immediately upgrade to versions 2.18.6, 2.20.3, 2.22.1 or 2.23.3 to minimize the risk of malicious attacks.

Security alerts aggregator Secunia rates the vulnerabilities as “moderately critical.”

The most serious vulnerability occurs because Bugzilla does not properly sanitize various fields when embedded in certain HTML headline tags.

“This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site,” Secunia warned.

Read more here about a Firefox flaw warning hoax.

A second error that happens when attachments in “diff” mode are viewed could let unauthenticated users read the descriptions of all attachments.

Additionally, when exporting bugs to the XML format, the “deadline” field is also visible for users, who are not members of the “timetrackinggroup” group. This can be exploited to gain knowledge of potentially sensitive information, the company explained.

Unpatched versions of Bugzilla also allow users to perform certain sensitive actions via HTTP GET and POST requests without verifying the user’s request properly. This can be exploited to modify, delete or create bugs.

Bugzilla is a free, Web-based tool used by software developers to track code bugs and defects. It was originally developed by the Mozilla Foundation and is widely used in the open-source community.

Check out eWEEK.com’s for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer’s Weblog.

Recommended for you...

Leadership Roundup: July Adjustments to Executive Benches

July saw major leadership shakeups across the channel, with key C-suite hires at Pipefy, Coro, Snowflake, Chainguard, and more.

Jordan Smith
Aug 1, 2025
July Roundup: AI, Cyber Key to Several M&A Developments

July’s M&A wave spotlighted AI security, with major players like Palo Alto Networks, Darktrace, and TD SYNNEX leading transformative deals.

Jordan Smith
Aug 1, 2025
Lemongrass Debuts Tool to Streamline SAP Clean Core Work

Lemongrass debuts Clean Core AI Accelerator to help SAP users cut complexity, reduce technical debt, and prepare ERP systems for cloud and AI upgrades.

Franklin Okeke
Jul 31, 2025
Trend Micro and Google Cloud Double Down on AI Security

The expanded alliance emphasizes AI-driven defenses, sovereign cloud capabilities, and new anti-scam protections for businesses worldwide.

Allison Francis
Jul 30, 2025
Channel Insider Logo

Channel Insider combines news and technology recommendations to keep channel partners, value-added resellers, IT solution providers, MSPs, and SaaS providers informed on the changing IT landscape. These resources provide product comparisons, in-depth analysis of vendors, and interviews with subject matter experts to provide vendors with critical information for their operations.

Property of TechnologyAdvice. © 2025 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.