Re: dangerous handling of security bugs
| From: | Rasmus Lerdorf | Date: | Sat, 10 Jul 2010 21:52:57 +0000 |
| Subject: | Re: dangerous handling of security bugs | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-49021@lists.php.net to get a copy of this message | ||
On 7/10/10 2:32 PM, Reindl Harald wrote:
> Why there are no point releases for security-bugs?
>
> The changelog form 5.3.2 to 5.3.3 RCx shows many
> security releases which are well known in the meantime
>
> It's VERY bad to schedule thmen always only with
> the normal bugfixes and also on production servers
> it can not be recommended to backport them by the admin
>
> So why there is no 5.3.2.1 which only fixes them?
None of the security issues are serious remotely exploitable ones. They
are all local.
-Rasmus