(no commit message)

[git.ikiwiki.info.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index b573b5f2348a3bea028706f1af7d5433b3b0f9a7..c3b62cd3c6395fb9072071f8f15da3af4679f542 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -482,9 +482,18 @@ Ludwig Nussel discovered a way for users to hijack root's tty when
 ikiwiki-mass-rebuild was run. Additionally, there was some potential
 for information disclosure via symlinks. ([[!cve CVE-2011-1408]])
 
 ikiwiki-mass-rebuild was run. Additionally, there was some potential
 for information disclosure via symlinks. ([[!cve CVE-2011-1408]])
 

-This hole was disconvered on 8 June 2011 and fixed the same day with
+This hole was discovered on 8 June 2011 and fixed the same day with

 the release of ikiwiki 3.20110608. Note that the fix is dependant on
 the release of ikiwiki 3.20110608. Note that the fix is dependant on

-a version of su that has a similar hole fixed; [[!debbug 628843]]
-tracks fixing the hole in Debian's su. An upgrade is a must for any
-sites that have `ikiwiki-update-wikilist` installed suid (not the default),
-and whose admins run `ikiwiki-mass-rebuild`.
+a version of su that has a similar hole fixed. Version 4.1.5 of the shadow
+package contains the fixed su; [[!debbug 628843]] tracks fixing the hole in
+Debian. An upgrade is a must for any sites that have `ikiwiki-update-wikilist`
+installed suid (not the default), and whose admins run `ikiwiki-mass-rebuild`.
+
+## javascript insertion via meta tags
+
+Raúl Benencia discovered an additional XSS exposure in the meta plugin.
+([[!cve CVE-2012-0220]])
+
+This hole was discovered on 16 May 2012 and fixed the same day with
+the release of ikiwiki 3.20120516. A fix was backported to Debian squeeze,
+as version 3.20100815.9. An upgrade is recommended for all sites.