X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/03b956ab4cb2fee8f7b93e725869060bb45fa4ea..f282512da75d19e38933f3083afa3c2a9dad463c:/debian/changelog diff --git a/debian/changelog b/debian/changelog index cca58b4f2..e1b8506ab 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,10 +1,34 @@ +ikiwiki (3.20141016.3) UNRELEASED; urgency=medium + + * img: stop ImageMagick trying to be clever if filenames contain a colon, + avoiding mis-processing + * HTML-escape error messages, in one case avoiding potential cross-site + scripting (OVE-20160505-0012) + * Mitigate ImageMagick vulnerabilities such as CVE-2016-3714: + - img: force common Web formats to be interpreted according to extension, + so that "allowed_attachments: '*.jpg'" does what one might expect + - img: restrict to JPEG, PNG and GIF images by default, again mitigating + CVE-2016-3714 and similar vulnerabilities + - img: check that the magic number matches what we would expect from + the extension before giving common formats to ImageMagick + + -- Simon McVittie Thu, 05 May 2016 23:33:26 +0100 + +ikiwiki (3.20141016.2) unstable; urgency=high + + [ Joey Hess ] + * Fix XSS in openid selector. Thanks, Raghav Bisht. (Closes: #781483) + + -- Simon McVittie Sun, 29 Mar 2015 22:28:15 +0100 + ikiwiki (3.20141016.1) unstable; urgency=medium * Backport selected commits for Debian 8: [ Joey Hess ] * Add missing build-depends on libcgi-formbuilder-perl, needed for - t/relativity.t + t/relativity.t if libipc-run-perl is also installed + (buildds are unaffected by this) * Set Debian package maintainer to Simon McVittie as I'm retiring from Debian. @@ -15,6 +39,7 @@ ikiwiki (3.20141016.1) unstable; urgency=medium [ Simon McVittie ] * Work around imagemagick Debian bug #771047 by using a non-blank SVG for the regression test, to avoid FTBFS in current unstable + if inkscape is installed (buildds are unaffected by this) -- Simon McVittie Wed, 07 Jan 2015 11:08:35 +0000