Exclude working directory from library path (CVE-2016-1238)

[git.ikiwiki.info.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 6d4841fe6f258d25eeb077dc0a650bfd35b25422..055e1d006c50d76e145f084012101e24f195f46d 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -514,12 +514,17 @@ CGI error messages did not escape HTML meta-characters, potentially
 allowing an attacker to carry out cross-site scripting by directing a
 user to a URL that would result in a crafted ikiwiki error message. This
 was discovered on 4 May by the ikiwiki developers, and the fixed version
 allowing an attacker to carry out cross-site scripting by directing a
 user to a URL that would result in a crafted ikiwiki error message. This
 was discovered on 4 May by the ikiwiki developers, and the fixed version

-3.20160506 was released on 6 May. An upgrade is recommended for sites using
-the CGI.
+3.20160506 was released on 6 May. The same fixes were backported to Debian
+8 "jessie" in version 3.20141016.3. A backport to Debian 7 "wheezy" is
+in progress.
+
+An upgrade is recommended for sites using
+the CGI. ([[!cve CVE-2016-4561]], OVE-20160505-0012)

 
 ## ImageMagick CVE-2016–3714 ("ImageTragick")
 
 
 ## ImageMagick CVE-2016–3714 ("ImageTragick")
 

-ikiwiki 3.20160506 attempts to mitigate [[!cve CVE-2016-3714]] and any
+ikiwiki 3.20160506 and 3.20141016.3 attempt to mitigate
+[[!cve CVE-2016-3714]], and any

 future ImageMagick vulnerabilities that resemble it, by restricting the
 image formats that the [[ikiwiki/directive/img]] directive is willing to
 resize. An upgrade is recommended for sites where an untrusted user is
 future ImageMagick vulnerabilities that resemble it, by restricting the
 image formats that the [[ikiwiki/directive/img]] directive is willing to
 resize. An upgrade is recommended for sites where an untrusted user is