K 10
svn:author
V 4
beat
K 8
svn:date
V 27
2012-11-15T08:50:06.591278Z
K 7
svn:log
V 1864
MFH 307425 by ohauer:
- bugzilla security updates to version(s)
  3.6.11, 4.0.8, 4.2.4

Summary
=======

The following security issues have been discovered in Bugzilla:

* Confidential product and component names can be disclosed to
  unauthorized users if they are used to control the visibility of
  a custom field.

* When calling the 'User.get' WebService method with a 'groups'
  argument, it is possible to check if the given group names exist
  or not.

* Due to incorrectly filtered field values in tabular reports, it is
  possible to inject code which can lead to XSS.

* When trying to mark an attachment in a bug you cannot see as
  obsolete, the description of the attachment is disclosed in the
  error message.

* A vulnerability in swfstore.swf from YUI2 can lead to XSS.

Feature safe:	yes

Security:	CVE-2012-4199
		https://bugzilla.mozilla.org/show_bug.cgi?id=731178

		CVE-2012-4198
		https://bugzilla.mozilla.org/show_bug.cgi?id=781850

		CVE-2012-4189
		https://bugzilla.mozilla.org/show_bug.cgi?id=790296

		CVE-2012-4197
		https://bugzilla.mozilla.org/show_bug.cgi?id=802204

		CVE-2012-5475
		https://bugzilla.mozilla.org/show_bug.cgi?id=808845
		http://yuilibrary.com/support/20121030-vulnerability/

MFH 307429 by ohauer:
- adjust required PgSQL module for bugzilla42

From Release Notes:
 PostgreSQL 9.2 requires DBD::Pg 2.19.3. (Bug 799721)

 No revision bump, p5-DBD-Pg-2.19.3
 a) not on per default
 b) in the tree since a view months

- add deprecation message to bugzilla3

From the announcement:
 Note that when Bugzilla 4.4 is released, the Bugzilla 3.6.x series
 will reach end of life. If you are using that series, we encourage
 you to upgrade to 4.2.4 now.

 http://groups.google.com/group/mozilla.support.bugzilla/browse_thread/thread/d8dcc99be0f89421

MFH 307430 by ohauer:
- fix german bugzilla templates (security fixes)

END