Bug-tracking system developed by Mozilla Project Maintained by:skv@FreeBSD.org Port Added: 07 Jun 2011 13:31:00 License: MPL
Bugzilla is one example of a class of programs called "Defect Tracking
Systems", or, more commonly, "Bug-Tracking Systems". Defect Tracking
Systems allow individual or groups of developers to keep track of
outstanding bugs in their product effectively.
Bugzilla has matured immensely, and now boasts many advanced features.
These include:
* integrated, product-based granular security schema
* inter-bug dependencies and dependency graphing
* advanced reporting capabilities
* a robust, stable RDBMS back-end
* extensive configurability
* a very well-understood and well-thought-out natural bug resolution
protocol
* email, XML, console, and HTTP APIs
* available integration with automated software configuration
management systems, including Perforce and CVS (through the
Bugzilla email interface and checkin/checkout scripts)
* too many more features to list
WWW: http://www.bugzilla.org/
- update to version 3.6.7
- CVE-2011-3657
- CVE-2011-3667
Summary
=======
The following security issues have been discovered in Bugzilla:
* When viewing tabular or graphical reports as well as new charts,
an XSS vulnerability is possible in debug mode.
* The User.offer_account_by_email WebService method lets you create
a new user account even if the active authentication method forbids
users to create an account.
* A CSRF vulnerability in post_bug.cgi and in attachment.cgi could
lead to the creation of unwanted bug reports and attachments.
All affected installations are encouraged to upgrade as soon as possible.
Full Release Notes:
http://www.bugzilla.org/security/3.4.12/
Approved by: skv@ (explicit)
- create missing (empty) directory (bugzilla) so checksetup does not fail
- use DIST_SUBDIR for bugzilla and all translations
- sort pkg-plist (genplist)
OK from bugzilla maintainers per PM.
PR: ports/158766
Submitted by: ohauer
