Secunia

Three security issues have been reported in Bugzilla, which can be exploited by malicious users to bypass certain security restrictions and gain knowledge of potentially sensitive information.

1) An error in "process_bug.cgi" can be exploited via a specially crafted HTTP POST request to remove keywords from a bug, even though the user doesn't have "edigbugs" permissions.

The issue affects versions 2.9 through 2.18rc2 and 2.19.

2) An error when exporting bugs to XML exposes user comments and attachment summaries marked as private to users, who are not members of the group allowed to see the comments.

Successful exploitation requires that the "insidergroup" feature is used.

The issue affects versions 2.17.1 through 2.18rc2 and 2.19.

3) Changes of various private attachment metadata (filename, description, MIME type, and review flags) are disclosed to users, who are not members of the group allowed to see private attachments.

Successful exploitation requires that the "insidergroup" feature is used.

The issue affects versions 2.17.1 through 2.18rc2 and 2.19.

Solution
The security issues have been fixed in versions 2.16.7, 2.18rc3, and in the 2.19.1 development snapshot.
Further details available in Customer Area

Provided and/or discovered by
1) Casey Klein
2) Joel Peshkin
3) Joel Peshkin

Original Advisory
http://www.bugzilla.org/security/2.16.6/

Deep Links
Links available in Customer Area