05:15 ohauer 

- update to 4.0.5

Vulnerability Details
=====================

Class:       Cross-Site Request Forgery
Versions:    4.0.2 to 4.0.4, 4.1.1 to 4.2rc2
Fixed In:    4.0.5, 4.2
Description: Due to a lack of validation of the enctype form
             attribute when making POST requests to xmlrpc.cgi,
             a possible CSRF vulnerability was discovered. If a user
             visits an HTML page with some malicious HTML code in it,
             an attacker could make changes to a remote Bugzilla installation
             on behalf of the victim's account by using the XML-RPC API
             on a site running mod_perl. Sites running under mod_cgi
             are not affected. Also the user would have had to be
             already logged in to the target site for the vulnerability
             to work.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=725663
CVE Number:  CVE-2012-0453

Approved by:    skv (implicit)

13:30 skv 

- Copy devel/bugzilla to devel/bugzilla3; russian/bugzilla-ru to
russian/bugzilla3-ru
- Update devel/bugzilla, russian/bugzilla-ru to 4.0.1
- Update devel/bugzilla3, russian/bugzilla3-ru to 3.6.5

Changes:        http://www.bugzilla.org/releases/4.0.1/release-notes.html
                http://www.bugzilla.org/releases/3.6.5/release-notes.html

06:00 tota 

- Update to 3.6.3-ru-20101117

Submitted by:   ohauer (via private e-mail)

12:52 skv 

Update to 3.6.2-ru-20100809

11:56 skv 

Update to 3.4.2-ru-20090923

Feature safe:   yes

15:40 skv 

Update to 3.2rc2-ru-1.0

15:44 skv 

Add bugzilla-ru , russian localization for Bugzilla.