non port: devel/bugzilla42/distinfo |
Number of commits found: 10 |
Sunday, 20 Apr 2014
|
17:26 ohauer
- update bugzilla to 4.4.4, 4.2.9, 4.0.13
- minor Makefile cleanup
This release fixes one regression introduced in Bugzilla by
security bug 968576: URLs in bug comments are displayed
correctly again. (Bug 998323)
Release Notes & Changes
=======================
Before installing or upgrading, you should read the Release Notes for
the new version of Bugzilla:
4.4.4: http://www.bugzilla.org/releases/4.4.4/release-notes.html
4.2.9: http://www.bugzilla.org/releases/4.2.9/release-notes.html
4.0.13: http://www.bugzilla.org/releases/4.0.13/release-notes.html
MFH: 2014Q2
|
Friday, 18 Apr 2014
|
18:54 ohauer
- commit forgotten distinfo
|
15:03 ohauer
- update to 4.0.12, 4.2.8, 4.4.3
- move BINMODE to Makefile.common so it is also used in the language packs
Security: CVE-2014-1517
Security: 608ed765-c700-11e3-848c-20cf30e32f6d
Security: 60bfa396-c702-11e3-848c-20cf30e32f6d
|
Thursday, 17 Oct 2013
|
19:35 ohauer
- update to latest release [1]
- use PKGNAMESUFFIX instead LATEST_LINK
- whitespace cleanup
- svn mv */bugzilla to */bugzilla40
- add vuxml entry
4.4.1, 4.2.7, and 4.0.11 Security Advisory
Wednesday Oct 16th, 2013
Summary
=======
Bugzilla is a Web-based bug-tracking system used by a large number of
software projects. The following security issues have been discovered
in Bugzilla:
* A CSRF vulnerability in process_bug.cgi affecting Bugzilla 4.4 only
can lead to a bug being edited without the user consent.
* A CSRF vulnerability in attachment.cgi can lead to an attachment
being edited without the user consent.
* Several unfiltered parameters when editing flagtypes can lead to XSS.
* Due to an incomplete fix for CVE-2012-4189, some incorrectly filtered
field values in tabular reports can lead to XSS.
All affected installations are encouraged to upgrade as soon as
possible.
[1] even bugzilla40 gets upstream fixes an upgrade to bugzilla42/44 is
recommend
Security: vid e135f0c9-375f-11e3-80b7-20cf30e32f6d
CVE-2013-1733
CVE-2013-1734
CVE-2013-1742
CVE-2013-1743
|
Thursday, 23 May 2013
|
21:49 ohauer
- update bugzilla42 to version 4.2.6 (bugfix release)
- remove RUN_DEPENDS for (already expired) perl 5.10
- update german/bugzilla42
- set expiration date for bugzilla3
The following important fixes/changes have been made in this release:
o MySQL 5.6 is now supported. (Bug 852560)
o A regression introduced in Bugzilla 4.2.4 made Oracle crash when
installing Bugzilla for the first time. (Bug 858911)
o If a custom field depends on a product, component or classification,
the "mandatory" bit was ignored on bug creation. (Bug 782210)
o Queries involving flags were broken in several ways.
These queries have been fixed. (Bug 828344)
o Tabular reports involving the empty resolution did not link bug
counts correctly. (Bug 212471)
o The Bug.search WebService method was returning all visible bugs
when called with no arguments, ignoring the max_search_results
and search_allow_no_criteria parameters. (Bug 859118)
Release Notes:
http://www.bugzilla.org/releases/4.2.6/release-notes.html
|
Wednesday, 20 Feb 2013
|
06:16 ohauer
- update bugzilla ports to latest version
Bugzilla 4.0.10 and 3.6.13 are security updates for the 4.0
branch and the 3.6 branch, respectively. 4.0.10 contains several
useful bug fixes and 3.6.13 contains only security fixes.
Security: CVE-2013-0785
CVE-2013-0786
|
Wednesday, 14 Nov 2012
|
19:29 ohauer
- bugzilla security updates to version(s)
3.6.11, 4.0.8, 4.2.4
Summary
=======
The following security issues have been discovered in Bugzilla:
* Confidential product and component names can be disclosed to
unauthorized users if they are used to control the visibility of
a custom field.
* When calling the 'User.get' WebService method with a 'groups'
argument, it is possible to check if the given group names exist
or not.
* Due to incorrectly filtered field values in tabular reports, it is
possible to inject code which can lead to XSS.
* When trying to mark an attachment in a bug you cannot see as
obsolete, the description of the attachment is disclosed in the
error message.
* A vulnerability in swfstore.swf from YUI2 can lead to XSS.
Feature safe: yes
Security: CVE-2012-4199
https://bugzilla.mozilla.org/show_bug.cgi?id=731178
CVE-2012-4198
https://bugzilla.mozilla.org/show_bug.cgi?id=781850
CVE-2012-4189
https://bugzilla.mozilla.org/show_bug.cgi?id=790296
CVE-2012-4197
https://bugzilla.mozilla.org/show_bug.cgi?id=802204
CVE-2012-5475
https://bugzilla.mozilla.org/show_bug.cgi?id=808845
http://yuilibrary.com/support/20121030-vulnerability/
|
Saturday, 1 Sep 2012
|
20:21 ohauer
fix distinfo
|
Friday, 27 Jul 2012
|
21:34 ohauer
- security update bugzilla
new Versions: 3.6.10, 4.0.7, 4.2.2
4.2.2
This release fixes two security issues. See the Security Advisory for details.
In addition, the following important fixes/changes have been made in this
release:
o A regression introduced in Bugzilla 4.0 caused some login names to be
ignored
when entered in the CC list of bugs. (Bug 756314)
o Some queries could trigger an invalid SQL query if strings entered by the
user
contained leading or trailing whitespaces. (Bug 760075)
o The auto-completion form for keywords no longer automatically selects the
first keyword in the list when the field is empty. (Bug 764517)
o A regression in Bugzilla 4.2 prevented classifications from being used in
graphical and tabular reports in the "Multiple Tables" field. (Bug 753688)
o Attachments created by the email_in.pl script were associated to the wrong
comment. (Bug 762785)
o Very long dependency lists can now be viewed correctly. (Bug 762783)
o Keywords are now correctly escaped in the auto-completion form to prevent
any
XSS abuse. (Bug 754561)
o A regression introduced in Bugzilla 4.0rc2 when fixing CVE-2011-0046 caused
the "Un-forget the search" link to not work correctly anymore when restoring
a
deleted saved search, because this link was lacking a valid token. (Bug
768870)
o Two minor CSRF vulnerabilities have been fixed which could let an attacker
alter your default search criteria in the Advanced Search page. (Bugs 754672
and 754673)
4.0.7
This release fixes one security issue. See the Security Advisory for details.
In addition, the following bugs have been fixed in this release:
o A regression introduced in Bugzilla 4.0 caused some login names to be
ignored
when entered in the CC list of bugs. (Bug 756314)
o Keywords are now correctly escaped in the auto-complete form to prevent any
XSS abuse. (Bug 754561)
o A regression introduced in Bugzilla 4.0rc2 when fixing CVE-2011-0046 caused
the "Un-forget the search" link to not work correctly anymore when restoring
a
deleted saved search, because this link was lacking a valid token. (Bug
768870)
3.6.10
This release fixes one security issue. See the Security Advisory for details.
http://www.bugzilla.org/security/3.6.9/
Approved by: implicit skv@ (bugzilla / bugzilla3)
Security: CVE-2012-1968
CVE-2012-1969
https://bugzilla.mozilla.org/show_bug.cgi?id=777398
https://bugzilla.mozilla.org/show_bug.cgi?id=777586
vid=58253655-d82c-11e1-907c-20cf30e32f6d
|
Wednesday, 25 Jul 2012
|
05:32 ohauer
- fix distinfo
|
Number of commits found: 10 |