Date: Fri, 27 Jul 2012 21:34:05 +0000 (UTC) From: Olli Hauer <ohauer@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r301625 - in head: devel/bugzilla devel/bugzilla3 devel/bugzilla42 security/vuxml Message-ID: <201207272134.q6RLY5oW048907@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ohauer Date: Fri Jul 27 21:34:04 2012 New Revision: 301625 URL: http://svn.freebsd.org/changeset/ports/301625 Log: - security update bugzilla new Versions: 3.6.10, 4.0.7, 4.2.2 4.2.2 This release fixes two security issues. See the Security Advisory for details. In addition, the following important fixes/changes have been made in this release: o A regression introduced in Bugzilla 4.0 caused some login names to be ignored when entered in the CC list of bugs. (Bug 756314) o Some queries could trigger an invalid SQL query if strings entered by the user contained leading or trailing whitespaces. (Bug 760075) o The auto-completion form for keywords no longer automatically selects the first keyword in the list when the field is empty. (Bug 764517) o A regression in Bugzilla 4.2 prevented classifications from being used in graphical and tabular reports in the "Multiple Tables" field. (Bug 753688) o Attachments created by the email_in.pl script were associated to the wrong comment. (Bug 762785) o Very long dependency lists can now be viewed correctly. (Bug 762783) o Keywords are now correctly escaped in the auto-completion form to prevent any XSS abuse. (Bug 754561) o A regression introduced in Bugzilla 4.0rc2 when fixing CVE-2011-0046 caused the "Un-forget the search" link to not work correctly anymore when restoring a deleted saved search, because this link was lacking a valid token. (Bug 768870) o Two minor CSRF vulnerabilities have been fixed which could let an attacker alter your default search criteria in the Advanced Search page. (Bugs 754672 and 754673) 4.0.7 This release fixes one security issue. See the Security Advisory for details. In addition, the following bugs have been fixed in this release: o A regression introduced in Bugzilla 4.0 caused some login names to be ignored when entered in the CC list of bugs. (Bug 756314) o Keywords are now correctly escaped in the auto-complete form to prevent any XSS abuse. (Bug 754561) o A regression introduced in Bugzilla 4.0rc2 when fixing CVE-2011-0046 caused the "Un-forget the search" link to not work correctly anymore when restoring a deleted saved search, because this link was lacking a valid token. (Bug 768870) 3.6.10 This release fixes one security issue. See the Security Advisory for details. http://www.bugzilla.org/security/3.6.9/ Approved by: implicit skv@ (bugzilla / bugzilla3) Security: CVE-2012-1968 CVE-2012-1969 https://bugzilla.mozilla.org/show_bug.cgi?id=777398 https://bugzilla.mozilla.org/show_bug.cgi?id=777586 vid=58253655-d82c-11e1-907c-20cf30e32f6d Modified: head/devel/bugzilla/Makefile head/devel/bugzilla/distinfo head/devel/bugzilla3/Makefile head/devel/bugzilla3/distinfo head/devel/bugzilla42/Makefile head/devel/bugzilla42/distinfo head/security/vuxml/vuln.xml Modified: head/devel/bugzilla/Makefile ============================================================================== --- head/devel/bugzilla/Makefile Fri Jul 27 17:06:03 2012 (r301624) +++ head/devel/bugzilla/Makefile Fri Jul 27 21:34:04 2012 (r301625) @@ -6,7 +6,7 @@ # PORTNAME= bugzilla -PORTVERSION= 4.0.6 +PORTVERSION= 4.0.7 CATEGORIES= devel MASTER_SITES= ${MASTER_SITE_MOZILLA} MASTER_SITE_SUBDIR= webtools webtools/archived Modified: head/devel/bugzilla/distinfo ============================================================================== --- head/devel/bugzilla/distinfo Fri Jul 27 17:06:03 2012 (r301624) +++ head/devel/bugzilla/distinfo Fri Jul 27 21:34:04 2012 (r301625) @@ -1,2 +1,2 @@ -SHA256 (bugzilla/bugzilla-4.0.6.tar.gz) = f1894a2b05556b2074b6b1e3c7230c52d458b9bb22737845c12c8c84e15fe22e -SIZE (bugzilla/bugzilla-4.0.6.tar.gz) = 2964924 +SHA256 (bugzilla/bugzilla-4.0.7.tar.gz) = edf3de89b8e6f16bdeaab4ef6b92902f6ed621bf2fcbc64430169ecf1004cfaf +SIZE (bugzilla/bugzilla-4.0.7.tar.gz) = 2801595 Modified: head/devel/bugzilla3/Makefile ============================================================================== --- head/devel/bugzilla3/Makefile Fri Jul 27 17:06:03 2012 (r301624) +++ head/devel/bugzilla3/Makefile Fri Jul 27 21:34:04 2012 (r301625) @@ -6,7 +6,7 @@ # PORTNAME= bugzilla -PORTVERSION= 3.6.9 +PORTVERSION= 3.6.10 CATEGORIES= devel MASTER_SITES= ${MASTER_SITE_MOZILLA} MASTER_SITE_SUBDIR= webtools webtools/archived Modified: head/devel/bugzilla3/distinfo ============================================================================== --- head/devel/bugzilla3/distinfo Fri Jul 27 17:06:03 2012 (r301624) +++ head/devel/bugzilla3/distinfo Fri Jul 27 21:34:04 2012 (r301625) @@ -1,2 +1,2 @@ -SHA256 (bugzilla/bugzilla-3.6.9.tar.gz) = 05d1fa9a7f0c9a75b9473959b0c9a0370608371da04e331c062ac8e21366af4b -SIZE (bugzilla/bugzilla-3.6.9.tar.gz) = 2508965 +SHA256 (bugzilla/bugzilla-3.6.10.tar.gz) = 97ba98a18dd71541bed94a2c58225a9ca621bf28a384d1dc9bdaeb792642b305 +SIZE (bugzilla/bugzilla-3.6.10.tar.gz) = 2508723 Modified: head/devel/bugzilla42/Makefile ============================================================================== --- head/devel/bugzilla42/Makefile Fri Jul 27 17:06:03 2012 (r301624) +++ head/devel/bugzilla42/Makefile Fri Jul 27 21:34:04 2012 (r301625) @@ -6,7 +6,7 @@ # PORTNAME= bugzilla -PORTVERSION= 4.2.1 +PORTVERSION= 4.2.2 CATEGORIES= devel MASTER_SITES= ${MASTER_SITE_MOZILLA} MASTER_SITE_SUBDIR= webtools webtools/archived Modified: head/devel/bugzilla42/distinfo ============================================================================== --- head/devel/bugzilla42/distinfo Fri Jul 27 17:06:03 2012 (r301624) +++ head/devel/bugzilla42/distinfo Fri Jul 27 21:34:04 2012 (r301625) @@ -1,2 +1,2 @@ -SHA256 (bugzilla/bugzilla-4.2.1.tar.gz) = 74b98b91bc4278f6242c62a2d94cc72f0eb029bc17fad5d5f40e187b9112ab4a -SIZE (bugzilla/bugzilla-4.2.1.tar.gz) = 2977293 +SHA256 (bugzilla/bugzilla-4.2.2.tar.gz) = 803b8b085b43c9a6fdd0392d35f392d7bdfb54f2ebfe76255e579b240e4cf29f +SIZE (bugzilla/bugzilla-4.2.2.tar.gz) = 2971786 Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Jul 27 17:06:03 2012 (r301624) +++ head/security/vuxml/vuln.xml Fri Jul 27 21:34:04 2012 (r301625) @@ -52,6 +52,57 @@ Note: Please add new entries to the beg --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="58253655-d82c-11e1-907c-20cf30e32f6d"> + <topic>bugzilla -- multiple vulnerabilities</topic> + <affects> + <package> + <range><ge>3.6.0</ge><lt>3.6.10</lt></range> + <range><ge>4.0.0</ge><lt>4.0.7</lt></range> + <range><ge>4.2.0</ge><lt>4.2.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>A Bugzilla Security Advisory reports:</h1> + <blockquote cite="http://www.bugzilla.org/security/3.6.9/">; + <p>The following security issues have been discovered in + Bugzilla:</p> + <h1>Information Leak</h1> + <p>Versions: 4.1.1 to 4.2.1, 4.3.1</p> + <p>In HTML bugmails, all bug IDs and attachment IDs are + linkified, and hovering these links displays a tooltip + with the bug summary or the attachment description if + the user is allowed to see the bug or attachment. + But when validating user permissions when generating the + email, the permissions of the user who edited the bug were + taken into account instead of the permissions of the + addressee. This means that confidential information could + be disclosed to the addressee if the other user has more + privileges than the addressee. + Plain text bugmails are not affected as bug and attachment + IDs are not linkified.</p> + <h1>Information Leak</h1> + <p>Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to + 4.2.1, 4.3.1</p> + <p>The description of a private attachment could be visible + to a user who hasn't permissions to access this attachment + if the attachment ID is mentioned in a public comment in + a bug that the user can see.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2012-1968</cvename> + <cvename>CVE-2012-1969</cvename> + <url>https://bugzilla.mozilla.org/show_bug.cgi?id=777398</url>; + <url>https://bugzilla.mozilla.org/show_bug.cgi?id=777586</url>; + </references> + <dates> + <discovery>2012-07-26</discovery> + <entry>2012-07-27</entry> + </dates> + </vuln> + <vuln vid="17f369dc-d7e7-11e1-90a2-000c299b62e1"> <topic>nsd -- Denial of Service</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201207272134.q6RLY5oW048907>