Security Holes: Bugzilla Recommends Update
The developers of the free bug tracking system, Bugzilla, advise users of older versions to update for security reasons.
Various branches of the Web-based system maintained by the project are affected: one vulnerability allows attackers exploit the "buildid" entry of a form for bug reporting to launch a cross-site scripting attack. Additionally, a call to "Email::Send::Sendmail()" can be exploited to inject malicious code.
Finally, a bug in the Web service interface (XML-RPC) gives a user access the time tracking entries for all reported bugs, even if the user does not have appropriate privileges.
The developers advise users with version 2.20.x or 2.22.x to update to version 2.20.5 or 2.22.3 respectively. Users with version 3.0 or 2.18.x should move to version 3.0.1. More recent versions are not affected by the bugs. Bugzilla offers a download here.
Issue 268/2023
Buy this issue as a PDF
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
SparkyLinux 6.6 Now Available for Installation
The Debian-based SparkyLinux has a new point release that retools the live USB desktop creator and other changes that give it shiny new-ness.
-
SparkyLinux 6.6 Now Available for Installation
The Debian-based SparkyLinux has a new point release that retools the live USB desktop creator and other changes that give it shiny new-ness.
-
Escuelas Linux 8.0 Now Available
Just in time for its 25th anniversary, the developers of Escuelas Linux have released the latest version.
-
LibreOffice 7.5 Loaded with New Features and Improvements
The favorite office suite of the Linux community has a new release that includes some visual refreshing and new features across all modules.
-
The Next Major Release of Elementary OS Has Arrived
It's been over a year since the developers of elementary OS released version 6.1 (Jólnir) but they've finally made their latest release (Horus) available with a renewed focus on the user.
-
KDE Plasma 5.27 Beta Is Ready for Testing
The latest beta iteration of the KDE Plasma desktop is now available and includes some important additions and fixes.
-
Netrunner OS 23 Is Now Available
The latest version of this Linux distribution is now based on Debian Bullseye and is ready for installation and finally hits the KDE 5.20 branch of the desktop.
-
New Linux Distribution Built for Gamers
With a Gnome desktop that offers different layouts and a custom kernel, PikaOS is a great option for gamers of all types.
-
System76 Beefs Up Popular Pangolin Laptop
The darling of open-source-powered laptops and desktops will soon drop a new AMD Ryzen 7-powered version of their popular Pangolin laptop.
-
Nobara Project Is a Modified Version of Fedora with User-Friendly Fixes
If you're looking for a version of Fedora that includes third-party and proprietary packages, look no further than the Nobara Project.