A vulnerability has been reported in Bugzilla, which can be exploited by malicious users to disclose sensitive information.

The vulnerability is caused due to an input validation error in the importxml.pl script when handling "filename" entries. This can be exploited to read arbitrary files from the local system via directory traversal attacks.

Successful exploitation requires that Bugzilla is configured to use the importxml.pl script with the "--attach_path" option.

The vulnerability is reported in versions prior to 2.22.5 and 3.0.5.

Solution
Update to version 2.22.5 or 3.0.5.

Provided and/or discovered by
The vendor credits Greg Hendricks, Frédéric Buclin, and Ilja van Sprundel.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.bugzilla.org/security/2.22.4/

https://bugzilla.mozilla.org/show_bug.cgi?id=437169

Deep Links
Links available to Secunia VIM customers