Date: Wed, 27 Oct 2004 19:23:53 +0000 (UTC) From: Pav Lucistnik <pav@FreeBSD.org> To: ports-committers@FreeBSD.org, cvs-ports@FreeBSD.org, cvs-all@FreeBSD.org Subject: cvs commit: ports/devel/bugzilla Makefile distinfo pkg-message Message-ID: <200410271923.i9RJNrMC010415@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
pav 2004-10-27 19:23:53 UTC
FreeBSD ports repository
Modified files:
devel/bugzilla Makefile distinfo pkg-message
Log:
- Update to 2.16.7, a security release:
Class: Unauthorized Bug Change
Versions: 2.9 through 2.18rc2 and 2.19
Description: It is possible to send a carefully crafted HTTP POST
message to process_bug.cgi which will remove keywords from
a bug even if you don't have permissions to edit all bug
fields (the "editbugs" permission). Such changes are
reported in "bug changed" email notifications, so they are
easily detected and reversed if someone abuses it.
Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=252638
- Correct SQL command in pkg-message
PR: ports/71161, ports/73166
Submitted by: Dmitry A Grigorovich <odip@bionet.nsc.ru>
Revision Changes Path
1.32 +1 -1 ports/devel/bugzilla/Makefile
1.12 +2 -2 ports/devel/bugzilla/distinfo
1.8 +3 -2 ports/devel/bugzilla/pkg-message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200410271923.i9RJNrMC010415>