A vulnerability has been reported in Bugzilla, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to the "offer_account_by_email()" function in WebService/User.pm improperly checking the "createemailregexp" parameter. This can be exploited to create user accounts on systems where the "SOAP::Lite" perl module is installed.

The vulnerability is reported in Bugzilla versions after 2.23.2 and prior to 3.0.2 and 3.1.2.

Solution
Update to 3.0.2 or 3.1.2.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Sascha Jensen and Frédéric Buclin.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.bugzilla.org/security/3.0.1/

https://bugzilla.mozilla.org/show_bug.cgi?id=395632

Deep Links
Links available to Secunia VIM customers