+ikiwiki (3.20161229~bpo8+1) jessie-backports; urgency=medium
+
+ * Rebuild for jessie-backports
+ - debian/tests/control: set INSTALLED_TESTS=1 here,
+ pkg-perl-autopkgtest in jessie didn't support
+ debian/tests/pkg-perl/smoke-env
+
+ -- Simon McVittie <smcv@debian.org> Thu, 29 Dec 2016 17:38:19 +0000
+
+ikiwiki (3.20161229) unstable; urgency=medium
+
+ * Security: force CGI::FormBuilder->field to scalar context where
+ necessary, avoiding unintended function argument injection
+ analogous to CVE-2014-1572. In ikiwiki this could be used to
+ forge commit metadata, but thankfully nothing more serious.
+ (CVE-2016-9646)
+ * Security: try revert operations in a temporary working tree before
+ approving them. Previously, automatic rename detection could result in
+ a revert writing outside the wiki srcdir or altering a file that the
+ reverting user should not be able to alter, an authorization bypass.
+ (CVE-2016-10026 represents the original vulnerability.)
+ The incomplete fix released in 3.20161219 was not effective for git
+ versions prior to 2.8.0rc0.
+ (CVE-2016-9645 represents that incomplete solution.)