From f282512da75d19e38933f3083afa3c2a9dad463c Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Thu, 5 May 2016 23:45:16 +0100 Subject: [PATCH] Changelog --- debian/changelog | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/debian/changelog b/debian/changelog index 36791fb59..e1b8506ab 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,19 @@ +ikiwiki (3.20141016.3) UNRELEASED; urgency=medium + + * img: stop ImageMagick trying to be clever if filenames contain a colon, + avoiding mis-processing + * HTML-escape error messages, in one case avoiding potential cross-site + scripting (OVE-20160505-0012) + * Mitigate ImageMagick vulnerabilities such as CVE-2016-3714: + - img: force common Web formats to be interpreted according to extension, + so that "allowed_attachments: '*.jpg'" does what one might expect + - img: restrict to JPEG, PNG and GIF images by default, again mitigating + CVE-2016-3714 and similar vulnerabilities + - img: check that the magic number matches what we would expect from + the extension before giving common formats to ImageMagick + + -- Simon McVittie Thu, 05 May 2016 23:33:26 +0100 + ikiwiki (3.20141016.2) unstable; urgency=high [ Joey Hess ] -- 2.39.5