Bugzilla is one example of a class of programs called "Defect Tracking
Systems", or, more commonly, "Bug-Tracking Systems". Defect Tracking
Systems allow individual or groups of developers to keep track of
outstanding bugs in their product effectively.
Bugzilla has matured immensely, and now boasts many advanced features.
These include:
* integrated, product-based granular security schema
* inter-bug dependencies and dependency graphing
* advanced reporting capabilities
* a robust, stable RDBMS back-end
* extensive configurability
* a very well-understood and well-thought-out natural bug resolution
protocol
* email, XML, console, and HTTP APIs
* available integration with automated software configuration
management systems, including Perforce and CVS (through the
Bugzilla email interface and checkin/checkout scripts)
* too many more features to list
WWW: http://www.bugzilla.org/
===> The following configuration options are available for bugzilla-4.0.10:
DOCS=on: Build and/or install documentation
MODPERL=off: mod_perl support
====> Options available for the group UI
PATCH_VIEWER=on: Patch Viewer
MORE_HTML=on: More HTML in Product/Group Descriptions
====> Database Engine
MYSQL=off: MySQL database support
PGSQL=off: PostgreSQL database support
====> Reports and Charts
GRAPHVIZ=off: Graphviz support
GRAPH_REPORTS=on: Graphical Reports
CHARTING_MODULES=on: Bug charting support
====> Attachment handling
BMP2PNG=off: BMP Attachments to PNGs
====> Email handling
INBOUND_EMAIL=off: Inbound Email
MAIL_QUEUEING=off: Mail Queueing
====> Web Services
XMLRPC=off: XML-RPC Interface
JSONRPC=off: JSON-RPC Interface
====> Alternative Authentication
LDAP=off: LDAP support
RADIUS=off: RADIUS protocol support
====> Administration
MOVE_BUGZ=off: Move Bugs Between Installations
EXPORT_IMPORT=off: Import/export bugs (via XML)
CONTRIB=on: Install user-contributed scripts
===> Use 'make config' to modify these settings
- update to latest release [1]
- use PKGNAMESUFFIX instead LATEST_LINK
- whitespace cleanup
- svn mv */bugzilla to */bugzilla40
- add vuxml entry
4.4.1, 4.2.7, and 4.0.11 Security Advisory
Wednesday Oct 16th, 2013
Summary
=======
Bugzilla is a Web-based bug-tracking system used by a large number of
software projects. The following security issues have been discovered
in Bugzilla:
(Only the first 15 lines of the commit message are shown above )
- Convert to new Uses/perl5.mk framework
- Resolve issues with implicit lang/perl in extract and patch dependencies
- Trim Makefile header
Reviewed by: bapt@ (exp-run)
Approved by: bapt@ (portmrg@)
- use OPTION_GROUP in all devel/bugzilla ports
- s/CONFLICTS/CONFLICTS_INSTALL/
- use easier CONFLICT notation (future proof)
- trim Makefile.common header
- update russian/bugzilla42 language template to version 4.2.6
- update bugzilla42 to version 4.2.6 (bugfix release)
- remove RUN_DEPENDS for (already expired) perl 5.10
- update german/bugzilla42
- set expiration date for bugzilla3
The following important fixes/changes have been made in this release:
o MySQL 5.6 is now supported. (Bug 852560)
o A regression introduced in Bugzilla 4.2.4 made Oracle crash when
installing Bugzilla for the first time. (Bug 858911)
o If a custom field depends on a product, component or classification,
the "mandatory" bit was ignored on bug creation. (Bug 782210)
o Queries involving flags were broken in several ways.
These queries have been fixed. (Bug 828344)
o Tabular reports involving the empty resolution did not link bug
counts correctly. (Bug 212471)
o The Bug.search WebService method was returning all visible bugs
when called with no arguments, ignoring the max_search_results
and search_allow_no_criteria parameters. (Bug 859118)
Release Notes:
http://www.bugzilla.org/releases/4.2.6/release-notes.html
- update bugzilla ports to latest version
Bugzilla 4.0.10 and 3.6.13 are security updates for the 4.0
branch and the 3.6 branch, respectively. 4.0.10 contains several
useful bug fixes and 3.6.13 contains only security fixes.
Security: CVE-2013-0785
CVE-2013-0786
- bugzilla security updates to version(s)
3.6.11, 4.0.8, 4.2.4
Summary
=======
The following security issues have been discovered in Bugzilla:
* Confidential product and component names can be disclosed to
unauthorized users if they are used to control the visibility of
a custom field.
* When calling the 'User.get' WebService method with a 'groups'
argument, it is possible to check if the given group names exist
or not.
(Only the first 15 lines of the commit message are shown above )
- security update bugzilla
new Versions: 3.6.10, 4.0.7, 4.2.2
4.2.2
This release fixes two security issues. See the Security Advisory for details.
In addition, the following important fixes/changes have been made in this
release:
o A regression introduced in Bugzilla 4.0 caused some login names to be
ignored
when entered in the CC list of bugs. (Bug 756314)
o Some queries could trigger an invalid SQL query if strings entered by the
user
contained leading or trailing whitespaces. (Bug 760075)
o The auto-completion form for keywords no longer automatically selects the
first keyword in the list when the field is empty. (Bug 764517)
(Only the first 15 lines of the commit message are shown above )
- new port bugzilla42
New Features and Improvements:
- Experimental SQLite Support
- Creating an Attachment by Pasting Text Into a Text Field
- HTML Bugmail (default: on can be disabled in user preference)
- Improved Searching System
- Disabling Old Components, Versions and Milestones
- Displaying a Custom Field Value Based on Multiple Values of Another Field
- Auditing of All Changes Within Bugzilla
- Accessibility Improvements
And many other Improvements, for complete list see:
http://www.bugzilla.org/releases/4.2.1/release-notes.html
graphics/ImageMagick can change package name via PKGNAMESUFFIX.
We should not rely on this.
Reported by: Jarrod Sayers <jarrod at downtools.com.au>
Pointy hat: az@
- update to 4.0.5
Vulnerability Details
=====================
Class: Cross-Site Request Forgery
Versions: 4.0.2 to 4.0.4, 4.1.1 to 4.2rc2
Fixed In: 4.0.5, 4.2
Description: Due to a lack of validation of the enctype form
attribute when making POST requests to xmlrpc.cgi,
a possible CSRF vulnerability was discovered. If a user
visits an HTML page with some malicious HTML code in it,
an attacker could make changes to a remote Bugzilla installation
on behalf of the victim's account by using the XML-RPC API
on a site running mod_perl. Sites running under mod_cgi
are not affected. Also the user would have had to be
already logged in to the target site for the vulnerability
to work.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=725663
CVE Number: CVE-2012-0453
Approved by: skv (implicit)
- update to version 3.6.7
- CVE-2011-3657
- CVE-2011-3667
Summary
=======
The following security issues have been discovered in Bugzilla:
* When viewing tabular or graphical reports as well as new charts,
an XSS vulnerability is possible in debug mode.
* The User.offer_account_by_email WebService method lets you create
a new user account even if the active authentication method forbids
users to create an account.
* A CSRF vulnerability in post_bug.cgi and in attachment.cgi could
lead to the creation of unwanted bug reports and attachments.
All affected installations are encouraged to upgrade as soon as possible.
Full Release Notes:
http://www.bugzilla.org/security/3.4.12/
Approved by: skv@ (explicit)
- create missing (empty) directory (bugzilla) so checksetup does not fail
- use DIST_SUBDIR for bugzilla and all translations
- sort pkg-plist (genplist)
OK from bugzilla maintainers per PM.
PR: ports/158766
Submitted by: ohauer
- bump because of mod_perl2 update
- order pkg-plist so it match autmated tools like genplist
- add missing empty directories (used by checksetup.pl) [1]
commit with hat apache@
PR: [1] ports/154295
Submitted by: me
- Update to 3.4.6 [1]
- Remove ja-bugzilla-2.* from CONFLICT entries of devel/bugzilla,
devel/bugzilla2 and russian/bugzilla-ru [2]
- Change MAINTAINER address from tota@rtfm.jp to tota@FreeBSD.org
[1] This port has been updated from the bugzilla Japanized patch to
bugzilla Japanese language pack installation, both of which are
maintained differently.
* Japanized patch is not actively maintained anymore.
* More sophisticated language pack framework has been introduced since
Bugzilla 3.0.
[2] This port no longer conflicts with those ports due to the new language
pack framework.
Approved by: maho (mentor)
- Remove mail/p5-Email-MIME-Creator, it has been folded into mail/p5-Email-MIME
- Remove mail/p5-Email-MIME-Modifier, it has been folded into mail/p5-Email-MIME
- Remove mail/p5-Email-Simple-Creator, it has been folded into
mail/p5-Email-Simple
- Adjust dependencies
Reported by: pointyhat
With hat: portmgr
* reflect renaming on CPAN File-Spec to PathTools
+ add devel/p5-PathTools, remove devel/p5-File-Spec
+ update dependencies for all affected ports (make them unconditional),
bump PORTREVISION for these ports
module was renamed
* reflect renaming on CPAN PodParser to Pod-Parser
+ add textproc/p5-Pod-Parser, remove textproc/p5-PodParser
+ update dependencies for all affected ports (make them unconditional),
bump PORTREVISION for these ports
* for all changed ports make dependencies on File::Temp, Digest::MD5,
Storable unconditional
* remove 'CONFIGURE_ARGS= INSTALLDIRS=site' from Makefile's
(this variable is forced by bsd.port.mk now)
* update Class-Autouse to 1.17
* update POE-API-Hooks to 1.05
* make portlint happy (clean IGNORE, convert spaces to tabs and so on)
- Update to 2.16.7, a security release:
Class: Unauthorized Bug Change
Versions: 2.9 through 2.18rc2 and 2.19
Description: It is possible to send a carefully crafted HTTP POST
message to process_bug.cgi which will remove keywords from
a bug even if you don't have permissions to edit all bug
fields (the "editbugs" permission). Such changes are
reported in "bug changed" email notifications, so they are
easily detected and reversed if someone abuses it.
Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=252638
- Correct SQL command in pkg-message
PR: ports/71161, ports/73166
Submitted by: Dmitry A Grigorovich <odip@bionet.nsc.ru>
Fix DIST_SUBDIR and make the port fetchable again.
Note that it is still vulnerable to
<http://www.freebsd.org/ports/portaudit/672975cb-d526-11d8-b479-02e0185c0b53.html>
Modifications to make this a master port for upcoming slave port
japanese/bugzilla. Should have no effect otherwise.
PR: ports/62545
Submitted by: TAKATSU Tomonari <tota@rtfm.jp>
There are several security related problem in bugzilla 2.16.3 and earlier,
The bugzilla developer released a security advisory.
see: http://www.bugzilla.org/security/2.16.3/
PR: 58905
Submitted by: Kang Liu
The devel/bugzilla port has an explicit LIB_DEPENDS dependency on
libmysqlclient.so.10 from the mysql323-client port. However, bugzilla
will work fine with just about any version of MySQL.
Could just insert USE_MYSQL, but the bugzilla port only really needs
access to the perl DBD::Mysql modules and can depend on MySQL
implicitly through that port..
PR: 57607
Submitted by: Matthew Seaman <m.seaman@infracaninophile.co.uk>
Conditionalise dependencies on databases/p5-DBI: for perl
5.005_03 use databases/p5-DBI-137 as newer versions do not
support the old perl.
Note that for some port, I merely removed the explicit
dependency as they already have implicit dependencies
via other ports.
Approved by: portmgr (marcus)
Fix a typo: s/NOPORTSDOCS/NOPORTDOCS/ for Makefile [1]
Use ${DOCSDIR} [2]
s/share\/doc\/.../%%DOCSDIR%%/ for pkg-plist [2]
PR: 53911
Submitted by: Oliver Eikemeier <eikemeier@fillmore-labs.com> [1]
osa [2]
Approved by: fjoe (mentor) (implicit)
- Fix something which has been broken in this port for a long time:
installation to ${PREFIX}/www/data.default. "data.default" was an artifact
of a long obsolete version of the Apache port. Put installation directory
under control of a variable $BUGZILLADIR instead. Carry through to
pkg-plist via a pragma.
- Bump $PORTREVISION.
Number of commits found: 123 (showing only 100 on this page)
