~ubuntu-branches/ubuntu/hardy/bugzilla/hardy-security : changes

~ubuntu-branches/ubuntu/hardy/bugzilla/hardy-security » Changes from revision 8

From Revision 8

Rev	Summary	Authors	Tags	Date
8	* SECURITY UPDATE: Directory traversal vulnerability in impo... * SECURITY UPDATE: Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attach_path is enabled, allows remote attackers to read arbitrary files via an XML file with a .. (dot dot) in the data element.(LP: #281915) - debian/patches/CVE-2008-4437.dpatch: upstream patch with regex to remove any leading path data from the filename. - CVE-2008-4437	Stefan Lesicnik	2.22.1-2.2ubuntu1.8.04.1	15 years ago
7	* Merge from Debian unstable, remaining changes: * Merge from Debian unstable, remaining changes: - debian/rules: Install whine.pl in /usr/share/bugzilla/lib. - debian/control: Update maintainer field.	Michael Bienia	2.22.1-2.2ubuntu1	16 years ago
6	* Merge from Debian unstable, remaining changes: * Merge from Debian unstable, remaining changes: - debian/rules: Install whine.pl in /usr/share/bugzilla/lib - Upate maintainer field in debian/control.	Michele Angrisano	2.22.1-2.1ubuntu1	16 years ago
5	* debian/rules: install whine.pl in /usr/share/bugzilla/lib * debian/rules: install whine.pl in /usr/share/bugzilla/lib * Closes (LP#: 65682)	Barry deFreese	2.22.1-2ubuntu1	16 years ago
4	* Depends on mysql-client as we provide mysql support with d... * Depends on mysql-client as we provide mysql support with dbconfig-common. (closes: #398621) * Urgency set to high to fix the etch RC bug. * Updated the Bugzilla version (debian minor) in Bugzilla/Config.pm.	Alexis Sukrieh	2.22.1-2	17 years ago
3	* NMU 0-days due to serious/important bug solving which prev... * NMU 0-days due to serious/important bug solving which prevents bugzilla entering testing. [ Alexis Sukrieh ] * Post-inst won't fail anymore when no MySQL server is available. Added an automatic way of setting up the MySQL server if /etc/mysql/debian.cnf exists, will read values from it then. (closes: #250638) * Using a MySQL user with '-' inside its name won't fail anymore. (closes unreported bug) * Better handling on DBI connection errors. When DBI complains about something, user is not confused anymore by ugly error messages. (closes: #154249) * Running checksetup.pl by hand won't break the Bugzilla's installation anymore. User can use it as he want without running dpkg-reconfigure. (closes: #200707) [ Francesco P. Lovergine ] * Now rules removes .cvsignore file which trashes /usr/share/bugzilla/template. * Added virtual package httpd to the list of web server. (closes: #213784)	Francesco Paolo Love...	2.16.7-0.2	19 years ago
2	Duplicate table creation is now also fixed in bugzilla.posti... Duplicate table creation is now also fixed in bugzilla.postinst (closes: #224288)	Rémi Perrot	2.16.5-2	20 years ago
1	Import upstream version 2.16.5 Import upstream version 2.16.5	Rémi Perrot	upstream-2.16.5	20 years ago