[Bug 1295438] New: CVE-2015-8509 bugzilla: information leak when parsing the CSV file

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1295438

Bug ID: 1295438
           Summary: CVE-2015-8509 bugzilla: information leak when parsing
                    the CSV file
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail],
                    [e-mail]

Upstream Bugzilla fixed the following issue:

If an external HTML page contains a <script> element with its src attribute
pointing to a buglist in CSV format, some web browsers incorrectly try to parse
the CSV file as valid JavaScript code. As the buglist is generated based on the
privileges of the user logged into Bugzilla, the external page could collect
confidential data contained in the CSV file.

This issue was fixed in versions 4.2.16, 4.4.11, and 5.0.2.

Upstream bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=1232785

[Bug 1295438] CVE-2015-8509 bugzilla: information leak when parsing the CSV file

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1295438

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1295439

--- Comment #1 from Martin Prpic  ---

Created bugzilla tracking bugs for this issue:

Affects: fedora-all [bug 1295439]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1295439
[Bug 1295439] CVE-2015-8509 bugzilla: information leak when parsing the CSV
file [fedora-all]

[Bug 1295438] CVE-2015-8509 bugzilla: information leak when parsing the CSV file

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1295438

Emmanuel Seyman  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from Emmanuel Seyman  ---
The update that fixes this issue was published late 2015 (this is update
FEDORA-2015-247b517a18, btw). I'm quite confident that this bug can be closed.

[Bug 1295438] CVE-2015-8509 bugzilla: information leak when parsing the CSV file

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1295438
Bug 1295438 depends on bug 1295439, which changed state.

Bug 1295439 Summary: CVE-2015-8509 bugzilla: information leak when parsing the CSV file [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1295439

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |EOL