diff options
| author | Amitai Schlair <schmonz@magnetic-babysitter.(none)> | 2009-08-30 16:34:32 -0400 |
|---|---|---|
| committer | Amitai Schlair <schmonz@magnetic-babysitter.(none)> | 2009-08-30 16:34:32 -0400 |
| commit | fe350e8b895be69471fad094fcdcf0b4c7d3beb3 (patch) | |
| tree | 5d48b57f583fedc2a9b765d3a9ea7b0c6c1d5891 /doc/security.mdwn | |
| parent | 1af7d7d8429b6e73493a5f8ba877c6cfb888cfe1 (diff) | |
| parent | 7021fc36466d80ca0c4105b82239d3ba008ade80 (diff) | |
Merge branch 'master' of git://github.com/joeyh/ikiwiki
Diffstat (limited to 'doc/security.mdwn')
| -rw-r--r-- | doc/security.mdwn | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/doc/security.mdwn b/doc/security.mdwn index 939d65d01..200ae29e2 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -417,3 +417,13 @@ attack. intrigeri discovered this problem on 12 Nov 2008 and a patch put in place later that day, in version 2.70. The fix was backported to testing as version 2.53.3, and to stable as version 1.33.7. + +## Insufficient blacklisting in teximg plugin + +Josh Triplett discovered on 28 Aug 2009 that the teximg plugin's +blacklisting of insecure TeX commands was insufficient; it could be +bypassed and used to read arbitrary files. This was fixed by +enabling TeX configuration options that disallow unsafe TeX commands. +The fix was released on 30 Aug 2009 in version 3.1415926, and was +backported to stable in version 2.53.4. If you use the teximg plugin, +I recommend upgrading. |