CVE-2005-3139

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary substring, even when the usevisibilitygroups parameter is set.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=112818466125484&w=2
http://secunia.com/advisories/17030/Patch, Vendor Advisory
http://www.bugzilla.org/security/2.18.4/Patch, Vendor Advisory
http://www.securityfocus.com/bid/14996Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/42799
http://marc.info/?l=bugtraq&m=112818466125484&w=2
http://secunia.com/advisories/17030/Patch, Vendor Advisory
http://www.bugzilla.org/security/2.18.4/Patch, Vendor Advisory
http://www.securityfocus.com/bid/14996Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/42799

Timeline

Published: Oct 5, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-31407.5Procom NetFORCE 800 4.02 M10 Build 20 and possibly other versions sends the NIS password map (passwd.nis) as a file attachment in diagnostic CVE-2005-31415.0Cerulean Studios Trillian 3.0 allows remote attackers to cause a denial of service (crash) via a reverse direct connection from a different CVE-2005-314210.0Heap-based buffer overflow in Kaspersky Antivirus (KAV) 5.0 and Kaspersky Personal Security Suite 1.1 allows remote attackers to execute arb CVE-2005-31435.0Unspecified vulnerability in the Mailbox Server for 4D WebStar before 5.3.5 allows attackers to cause a denial of service (crash) via IMAP c CVE-2005-31445.0httpAdapter.c in sblim-sfcb before 0.9.2 allows remote attackers to cause a denial of service via long HTTP headers.CVE-2005-31455.0httpAdapter.c in sblim-sfcb before 0.9.2 allows remote attackers to cause a denial of service (resource consumption) by connecting to sblim-CVE-2005-31462.1StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files.CVE-2005-31472.1StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information.CVE-2005-31484.6StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered CVE-2005-31494.6Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid applicat CVE-2005-31507.5Format string vulnerability in the Log_Flush function in Weex 2.6.1.5, 2.6.1, and possibly other versions allows remote FTP servers to execu CVE-2005-31517.5Buffer overflow in blenderplay in Blender Player 2.37a allows attackers to execute arbitrary code via a long command line argument.