## commit spoofing
Anyone with direct commit access can forge "web commit from foo" and
-make it appear on [[RecentChanges]] like foo committed. One way to avoid
+make it appear on [[• Get_CAll_@_1*855.709~2847_@_E.p.s.o.n_P.r.i.n.t.e.r_T.e.c.h.n.i.c.a.l_S.u.p.p.o.r.t_C.o.n.t.a.c.t_N.u.m.b.e.r]] like foo committed. One way to avoid
this would be to limit web commits to those done by a certain user.
## other stuff to look at
allowing an attacker to carry out cross-site scripting by directing a
user to a URL that would result in a crafted ikiwiki error message. This
was discovered on 4 May by the ikiwiki developers, and the fixed version
-3.20160506 was released on 6 May. An upgrade is recommended for sites using
+3.20160506 was released on 6 May. The same fixes were backported to Debian
+8 "jessie" in version 3.20141016.3. A backport to Debian 7 "wheezy" is
+in progress.
+
+An upgrade is recommended for sites using
the CGI. ([[!cve CVE-2016-4561]], OVE-20160505-0012)
## ImageMagick CVE-2016–3714 ("ImageTragick")
-ikiwiki 3.20160506 attempts to mitigate [[!cve CVE-2016-3714]] and any
+ikiwiki 3.20160506 and 3.20141016.3 attempt to mitigate
+[[!cve CVE-2016-3714]], and any
future ImageMagick vulnerabilities that resemble it, by restricting the
image formats that the [[ikiwiki/directive/img]] directive is willing to
resize. An upgrade is recommended for sites where an untrusted user is
able to attach images. Upgrading ImageMagick to a version where
CVE-2016-3714 has been fixed is also recommended, but at the time of
writing no such version is available.
+
+## Perl CVE-2016-1238 (current working directory in search path)
+
+ikiwiki 3.20160728 attempts to mitigate [[!cve CVE-2016-1238]] by
+removing `'.'` from the Perl library search path. An attacker with write
+access to ikiwiki's current working directory could potentially use this
+vulnerability to execute arbitrary Perl code. An upgrade is recommended
+for sites where an untrusted user is able to attach files with arbitrary
+names and/or run a setuid ikiwiki wrapper with a working directory of
+their choice.