Pav Lucistnik a6b9ddac1d - Update to 2.16.7, a security release: ... Class: Unauthorized Bug Change Versions: 2.9 through 2.18rc2 and 2.19 Description: It is possible to send a carefully crafted HTTP POST message to process_bug.cgi which will remove keywords from a bug even if you don't have permissions to edit all bug fields (the "editbugs" permission). Such changes are reported in "bug changed" email notifications, so they are easily detected and reversed if someone abuses it. Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=252638 - Correct SQL command in pkg-message PR: ports/71161, ports/73166 Submitted by: Dmitry A Grigorovich <odip@bionet.nsc.ru>		2004-10-27 19:23:53 +00:00
..
files	[PATCH] devel/bugzilla: update to 2.16.6	2004-07-17 05:22:20 +00:00
distinfo	- Update to 2.16.7, a security release:	2004-10-27 19:23:53 +00:00
Makefile	- Update to 2.16.7, a security release:	2004-10-27 19:23:53 +00:00
pkg-descr
pkg-message	- Update to 2.16.7, a security release:	2004-10-27 19:23:53 +00:00
pkg-plist	[PATCH] devel/bugzilla: update to 2.16.6	2004-07-17 05:22:20 +00:00