Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=219937
Summary: CVE-2006-6574: mantis < 1.1.0a2 information disclosure Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: normal Component: mantis AssignedTo: giallu@gmail.com ReportedBy: ville.skytta@iki.fi QAContact: extras-qa@fedoraproject.org CC: extras-qa@fedoraproject.org,fedora-security- list@redhat.com
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-6574
"Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows remote attackers to obtain sensitive information by reading the Change column, as demonstrated by the Change column of a custom field."
All FE releases are possibly affected.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: CVE-2006-6574: mantis < 1.1.0a2 information disclosure
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=219937
------- Additional Comments From giallu@gmail.com 2007-01-09 06:38 EST ------- mantis references:
http://www.mantisbt.org/bugs/view.php?id=7364 http://www.mantisbt.org/bugs/view.php?id=3375
both fixed in CVS
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: CVE-2006-6574: mantis < 1.1.0a2 information disclosure
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=219937
giallu@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution| |CURRENTRELEASE Fixed In Version| |1.0.6-2
------- Additional Comments From giallu@gmail.com 2007-01-12 18:11 EST ------- Patched packages are now published in all branches (FC5, FC6 and devel)
security@lists.fedoraproject.org