346525 - Security Advisory for 2.18.6, 2.20.3, 2.22.1, and 2.23.3

Status: RESOLVED FIXED

(Bugzilla :: bugzilla.org, defect)

Description

[Frédéric Buclin]

There are many security bugs I would like to see fixed in our next set of releases, see dependencies. I'm actively working on them. And so we will need a SecAdv.

Comment 1

[Frédéric Buclin]

*** Bug 346524 has been marked as a duplicate of this bug. ***

Comment 2

[Frédéric Buclin]

Bug 38862 won't be taken for these releases, as it's conflicting with bug 346086. We will fix it next time. :)

Note that all other security bugs have been reviewed!

Comment 3

[Max Kanat-Alexander]

Attachment: Security Advisory

Okay, here's the advisory. I'll also send an email to security@ to let them know that it's up here.

Comment 4

[Frédéric Buclin]

Comment on attachment 239870 [details]
Security Advisory

>We strongly advise that 2.18.x users upgrade to 2.18.6. 2.20.x users
>should upgrade to 2.22.3.

s/2.22.3/2.20.3/


>* The Bugzilla Project would like to express special thanks to 
>  Frédéric.

Yay! Thanks a lot! :)


I didn't check the affected version numbers, but they look correct at first glance. r=LpSolit with the typo above fixed.

Comment 5

[Frédéric Buclin]

Adding bug 355728 to the list. The sec adv will have to be updated accordingly.

Comment 6

[Max Kanat-Alexander]

Attachment: v2

Okay, here's the updated Security Advisory.

In the Credits section, I guessed at the name for the reporter of Issue 6 (based on his email address). I also emailed him directly to ask for his name.

Comment 7

[Frédéric Buclin]

Comment on attachment 242239 [details]
v2

>We strongly advise that 2.18.x users upgrade to 2.18.6. 2.20.x users
>should upgrade to 2.22.3.


As I said in my previous review, 2.22.3 doesn't exist yet. :) It must be 2.20.3. Please fix that on checkin. r=LpSolit

Comment 8

[Max Kanat-Alexander]

He emailed me back, his full name is Adam Merrifield. (<-- Note to self.)

Comment 9

[Max Kanat-Alexander]

Okay, this has been put up on the staging site with the corrections pointed out by LpSolit.

Comment 10

[Max Kanat-Alexander]

Okay, I've sent the advisory, to announce, support-bugzilla, and BugTraq.