FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2007-4538

This CVE name corresponds to:

Entered Topic
2007-09-21 bugzilla -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2007-4538
Phase Assigned(20070827)

Description

email_in.pl in Bugzilla 2.23.4 through 3.0.0 allows remote attackers to execute arbitrary commands via the -f (From address) option to the Email::Send::Sendmail function, probably involving shell metacharacters.

References

Source Reference
BUGTRAQ 20070823 Security Advisory for Bugzilla 3.0, 2.22.1, and 2.20.4
MISC https://bugzilla.mozilla.org/show_bug.cgi?id=386860
CONFIRM http://www.bugzilla.org/security/2.20.4/
GENTOO GLSA-200709-18
BID 25425
VUPEN ADV-2007-2977
OSVDB 37203
SECTRACK 1018604
SECUNIA 26584
SECUNIA 26971
XF bugzilla-sendmail-command-execution(36243)