Description
The shadow database feature (syncshadowdb) in Bugzilla 2.9 through 2.16.10 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
References (10)
Core 10
Core References
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2006/dsa-1208
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/302
Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/18218
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/16061
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/420353/100/0/threaded
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/22826
Patch x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=305353
Patch x_refsource_misc
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=329387
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/23863
Patch vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1015411
Scores
EPSS
0.0153
EPSS Percentile
71.9%
Details
Status
published
Products (20)
mozilla/bugzilla
2.9
mozilla/bugzilla
2.10
mozilla/bugzilla
2.12
mozilla/bugzilla
2.14
mozilla/bugzilla
2.14.1
mozilla/bugzilla
2.14.2
mozilla/bugzilla
2.14.3
mozilla/bugzilla
2.14.4
mozilla/bugzilla
2.14.5
mozilla/bugzilla
2.16
... and 10 more
Published
Dec 28, 2005
Tracked Since
Feb 18, 2026