Bugzilla Bug 124614

Just got a mail from the gallery-announce list:

Gallery 2.0.3 is now available for download. This release adds no new features.
It fixes a minor XSS exploit and an exploit in the session code that could
allow users to remotely delete session files. These security flaws were
discovered during an independent audit by James Bercegay from GulfTech Security
Research who reported them to us and worked with us to provide an appropriate
solution. There are no known exploits of these flaws in the wild. However we
strongly recommend that you upgrade to version 2.0.3 as soon as possible.
Please follow our upgrading instructions and download and install the latest
release.

Upgrading is quick and easy and will help you ensure the security of your
system.  Visit http://gallery.menalto.com/gallery_2.0.3_released for more
details.

Patch Files:
http://codex.gallery2.org/index.php/Gallery2:Download#Upgrades

Instructions:
http://codex.gallery2.org/index.php/Gallery2:Upgrading_to_2.0.x

If you have any questions, please ask in the Gallery 2 forums:
http://gallery.menalto.com/forum/62

regards,
The Gallery Team

Created an attachment (id=81178) [details]
Possible 2.0.3 ebuild?

I commented out the ffmpeg patch, because I didn't wasn't 100% sure if it
needed to be applied.

Created an attachment (id=81179) [details]
faster, harder, better, stronger!

I've uncommented the patch line after looking at the 2.0.3 source and finding
the elderly "singlejpeg" line.

Updating status, web-apps please bump

bumped

Arches please test and mark 2.0.3 stable

sparc done.

hppa done.

*** Bug 124612 has been marked as a duplicate of this bug. ***

x86.. handled.

ppc stable

amd64 stable.

2.0.4 just came out, another security release.  Renaming to 2.0.4 should work
fine.

Thanks for informing us, I created a new bug for 2.0.4 (bug #125830). Also
added the new bug as depending as a headsup, because we'll probably handle both
bugs in one GLSA.

Uncalling arch since we'll have to release 2.0.4 as security fix too.

in CVS

closing without glsa, feel free to reopen if you disagree.