727896 - Security advisory for Bugzilla 4.2 and 4.0.5

Status: RESOLVED FIXED

(Bugzilla :: bugzilla.org, defect)

Description

[Frédéric Buclin]

Sec adv needed for bug 725663, affecting all supported branches.

Comment 1

[Frédéric Buclin]

(In reply to Frédéric Buclin from comment #0)
> Sec adv needed for bug 725663, affecting all supported branches.

It appeared that only 4.0.2 and newer are affected. So no security release for 3.x needed.

Comment 2

[David Lawrence [:dkl]]

Attachment: 4.0.4 sec adv (v1)

Comment 3

[Frédéric Buclin]

Comment on attachment 598312 [details]
4.0.4 sec adv (v1)

>software projects. The following security issues have been discovered

There is only one issue, so it must be singular, not plural.


>Versions:    4.0.2 to 4.0.4, 4.1.1 to 4.2

4.2 -> 4.2rc2.


>The fixes for these issues are included in the 4.0.5
>and 4.2 releases. Upgrading to a release with the relevant fixes will
>protect your installation from possible exploits of these issues.

Same as above. Only one fix.


>If you are unable to upgrade but would like to patch just the
>individual security vulnerabilities, there are patches available for
>each issue at the "References" URL for each vulnerability.

Same here. "For each issue" doesn't make sense when there is only one.


>Frédéric Buclin
>Byron Jones
>Mario Gomes
>David Lawrence

Should be:
dkl, glob, me, mario, in this order.

Comment 4

[David Lawrence [:dkl]]

Attachment: 4.0.4 sec adv (v2)

Comment 5

[Frédéric Buclin]

Comment on attachment 598319 [details]
4.0.4 sec adv (v2)

r=LpSolit

Comment 6

[Frédéric Buclin]

Security advisory sent.