2.20.3, 2.22.1, and 2.23.3 Security AdvisoryFebruary 2, 2007
block in the Apache configuration for the directory containing Bugzilla. This block fails to include permission for .htaccess files to override file access permissions. The .htaccess file shipped with Bugzilla prohibits access by web browsers to read the localconfig file, which contains the username and password for connecting to the database server. If you are not running Bugzilla under mod_perl, then this does not affect you. Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=367071 Vulnerability Solutions ======================= The fixes for all of the security bugs mentioned in this advisory are included in the 2.20.4, 2.22.2, and 2.23.4 releases. Upgrading to these releases will protect installations from possible exploits of these issues. Full release downloads, patches to upgrade Bugzilla from previous versions, and CVS upgrade instructions are available at: http://www.bugzilla.org/download/ Specific patches for each of the individual issues can be found on the corresponding bug reports for each issue, at the URL given in the reference for that issue in the list above. Credits ======= The Bugzilla team wish to thank the following people for their assistance in locating, advising us of, and assisting us to fix these situations: Frédéric Buclin Dave Miller Olav Vitters Max Kanat-Alexander General information about the Bugzilla bug-tracking system can be found at: http://www.bugzilla.org/ Comments and follow-ups can be directed to the mozilla.support.bugzilla newsgroup or the support-bugzilla mailing list. http://www.bugzilla.org/support/ has directions for accessing these forums.