48711e5421
Many changes, most notable security fixes:
Class: Information Leak
Versions: All versions prior to 2.16.6 and 2.18rc1
Description: If Bugzilla is configured to hide entire products from some
users, both duplicates.cgi and the form for mass-editing a
list of bugs in buglist.cgi can disclose the names of those
hidden products to such users.
References: http://bugzilla.mozilla.org/show_bug.cgi?id=234825
http://bugzilla.mozilla.org/show_bug.cgi?id=234855
Class: Cross-site scripting vulnerability
Versions: All versions prior to 2.16.6 and 2.18rc1
Description: Several administration CGIs echo invalid data back to the
user without escaping it.
Reference: http://bugzilla.mozilla.org/show_bug.cgi?id=235265
Class: Remote SQL injection vulnerability
Versions: All versions prior to 2.16.6 and 2.18rc1
Description: A user with privileges to grant membership to any group
(i.e. usually an administrator) can trick editusers.cgi
into executing arbitrary SQL.
Reference: http://bugzilla.mozilla.org/show_bug.cgi?id=244272
Also treat bugzilla.conf and localconfig as CONF_FILES
|
||
|---|---|---|
| .. | ||
| files | ||
| DEINSTALL | ||
| DESCR | ||
| distinfo | ||
| Makefile | ||
| MESSAGE | ||
| PLIST | ||
| TODO | ||