Are there any security problems with Bugzilla?

Bugzilla FAQ

(Continued from previous question...)

40. Are there any security problems with Bugzilla?

The Bugzilla code has not undergone a complete security audit. It is recommended that you closely examine permissions on your Bugzilla installation, and follow the recommended security guidelines.

(Continued on next question...)

Other Interview Questions

• What is Bugzilla?
• What is Bugzilla's features?
• Why should you use Bugzilla?
• Bugzilla Components
• How to create a Bugzilla Account?
• How do I change my user name in Bugzilla??
• What is The Bugzilla Query Page?
• What is about the Bug List page?
• How to Write a Useful Bug Report with Bugzilla
• How to Enter your Useful Bug Report into Bugzilla
• How to manage a Bug Reports with Bugzilla
• Where can I find my user preferences?
• What about Account Settings page?
• What about Email Settings page?
• What about "Watching" Users functionality?
• What about Page Footer ?
• How does Bugzilla stack up against other bug-tracking databases?
• Is Bugzilla web-based or do you have to have specific software or specific operating system on your machine?
• Does Bugzilla allow the user to track multiple projects?
• If I am on many projects, and search for all bugs assigned to me, will Bugzilla list them for me and allow me to sort by project, severity etc?
• Does Bugzilla allow attachments (text, screenshots, urls etc)? If yes, are there any that are NOT allowed?
• Does Bugzilla allow us to define our own priorities and levels? Do we have complete freedom to change the labels of fields and format of them, and the choice of acceptable values?
• Does Bugzilla provide any reporting features, metrics, graphs, etc?
• The index.html page doesn't show the footer. It's really annoying to have to go to the querypage just to check my "my bugs" link. How do I get a footer on static HTML pages?
• Is there email notification and if so, what do you see when you get an email? Do you see bug number and title or is it only the number?
• Can email notification be set up to send to multiple people, some on the To List, CC List, BCC List etc?
• Can email notification be set up to send to multiple people, some on the To List, CC List, BCC List etc?
• If there is email notification, do users have to have any particular type of email application?
• If I just wanted to track certain bugs, as they go through life, can I set it up to alert me via email whenever that bug changes, whether it be owner, status or description etc.?
• Does Bugzilla allow data to be imported and exported? If I had outsiders write up a bug report using a MS Word bug template, could that template be imported into "matching" fields? If I wanted to take the results of a query and export that data to MS Excel, could I do that?
• Has anyone converted Bugzilla to another language to be used in other countries? Is it localizable?
• Can a user create and save reports? Can they do this in Word format? Excel format?
• Can a user re-run a report with a new project, same query?
• Can a user modify an existing report and then save it into another name?
• Does Bugzilla have the ability to search by word, phrase, compound search?
• Can the admin person establish separate group and individual user privileges?
• Does Bugzilla provide record locking when there is simultaneous access to the same bug? Does the second person get a notice that the bug is in use or how are they notified?
• Are there any backup features provided?
• Can users be on the system while a backup is in progress?
• Are there any security problems with Bugzilla?
• I don't like/want to use Procmail to hand mail off to bug_email.pl. What alternatives do I have?
• How do I set up the email interface to submit/change bugs via email?
• Bugzilla can be used with Oracle?
• Bugs are missing from queries, but exist in the database (and I can pull them up by specifying the bug ID). What's wrong?
• I think my database might be corrupted, or contain invalid entries. What do I do?
• I want to manually edit some entries in my database. How?
• I try to add myself as a user, but Bugzilla always tells me my password is wrong.
• I think I've set up MySQL permissions correctly, but bugzilla still can't connect.
• How do I synchronize bug information among multiple different Bugzilla databases?
• Why do I get bizarre errors when trying to submit data, particularly problems with "groupset"?
• How come even after I delete bugs, the long descriptions show up?
• I can't upload anything into the database via the "Create Attachment" link. What am I doing wrong?
• How do I change a keyword in Bugzilla, once some bugs are using it?
• Bugzilla Database Basics
• Step-by-step Install Bugzilla
• Red Hat Bugzilla - What is it?
• Red Hat Bugzilla - How do I enter a bug?
• Red Hat Bugzilla - What happens once I enter a bug?
• Red Hat Bugzilla - How do I search for a bug?
• Red Hat Bugzilla - How do I submit a patch?
• Red Hat Bugzilla - Are cookies required?
• Camino Project - What to do with a bug or feature request?
• Camino Project - I found a bug. What should I do?
• Camino crashed! What do I do now?
• Camino keeps displaying the “spinning beachball” and does not respond.
• There’s a problem with a page that requires a login.
• I want a new feature. What should I do?
• Can’t I just post a message about the bug/feature in the forum instead?
• Why hasn’t my bug been fixed yet?
• Why was my bug marked WONTFIX?
• If only some people want a feature, couldn’t it just be a preference?