09:50 ohauer 

- update to 5.0.4
- remove p5-File-Slurp dependency (see Bugzilla/Install/Requirements.pm)

MFH:            2018Q1
Security:       CVE-2018-5123
Security:       vid: 22283b8c-13c5-11e8-a861-20cf30e32f6d

 

19:12 ohauer 

- update to 5.0.3

Thanks to Mokhi for review latest 5.0.x PR's and patches!

Security:	CVE-2016-2803
Security:	036d6c38-1c5b-11e6-b9e0-20cf30e32f6d

 

11:22 ohauer 

- update to 5.0.2

This release fixes two security issues.
See the Security Advisory for details. [1]

This release also contains the following bug fixes:
 o mod_perl now works correctly with mod_access_compat turned off on
   Apache 2.4. To regenerate the .htaccess files, you must first delete
   all existing ones in subdirectories:

    find . -mindepth 2 -name .htaccess -exec rm -f {} \;

   You must then run checksetup.pl again to recreate them with the correct
syntax.
   (Bug 1223790)

 o Emails sent by Bugzilla are now correctly encoded as UTF-8. (Bug 714724)
 o Strawberry Perl is now fully supported on Windows. (Bug 1089448 and bug
987742)
 o The XML-RPC API now works with IIS on Windows. (Bug 708252)
 o Some queries should now be faster on PostgreSQL. (Bug 1184431)

[1] https://www.bugzilla.org/security/4.2.15/

MFH:		2015Q4
Security:	CVE-2015-8508
		CVE-2015-8509
		vid="54075861-a95a-11e5-8b40-20cf30e32f6d"

 

04:10 ohauer 

- update bugzilla ports to 5.0.1 / 4.4.10

o Users whose login name is not an email address could not log in on
  installations which use LDAP to authenticate users.
o If a mandatory custom field was hidden, it was not possible to create a
  new bug or to edit existing ones.
o A user editing his login name to point to a non-existent email address
  could cause Bugzilla to stop working, causing a denial of service.
o Emails generated during a transaction made PostgreSQL stop working.
o Bugs containing a comment with a reference to a bug ID larger than 2^31
  could not be displayed anymore using PostgreSQL.
o Emails sent by Bugzilla are now correctly encoded as UTF-8.
o The date picker in the "Time Summary" page was broken.
o If Test::Taint or any other Perl module required to use the JSON-RPC API
  was not installed or was too old, the UI to tag comments was displayed
  anyway, you could tag comments, but tags were not persistent (they were
  lost on page reload). Now the UI to tag comments is not displayed at all
  until the missing Perl modules are installed and up-to-date.
o Custom fields of type INTEGER now accept negative integers.

MFH:		2015Q3
Security:	CVE-2015-4499
Security:	ea893f06-5a92-11e5-98c0-20cf30e32f6d

 

07:57 ohauer 

- add bugzilla 5.0

Release Notes:
https://www.bugzilla.org/releases/5.0/release-notes.html