diff options
| author | Joey Hess <joey@gnu.kitenet.net> | 2009-08-30 15:20:32 -0400 |
|---|---|---|
| committer | Joey Hess <joey@gnu.kitenet.net> | 2009-08-30 15:20:32 -0400 |
| commit | 41122048b924ffa16ef8e1f77730f15b455733b0 (patch) | |
| tree | 1c385032673fc5ea622349c6b393875c8119c4e9 | |
| parent | b83cb1d9f5ad1bc3eab332a75ecd958d63610ce9 (diff) | |
| download | ikiwiki-41122048b924ffa16ef8e1f77730f15b455733b0.tar ikiwiki-41122048b924ffa16ef8e1f77730f15b455733b0.tar.gz | |
teximg security problem
| -rw-r--r-- | doc/security.mdwn | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/doc/security.mdwn b/doc/security.mdwn index 939d65d01..ba3eac187 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -417,3 +417,13 @@ attack. intrigeri discovered this problem on 12 Nov 2008 and a patch put in place later that day, in version 2.70. The fix was backported to testing as version 2.53.3, and to stable as version 1.33.7. + +## Insufficient blacklisting in teximg plugin + +Josh Tripplet discovered on 28 Aug 2009 that the teximg plugin's +blacklisting of insecure TeX commands was insufficient; it could be +bypassed and used to read arbitrary files. This was fixed by +enabling TeX configuration options that disallow unsafe TeX commands. +The fix was released on 30 Aug 2009 in version 3.1415926, and was +backported to stable in version 2.53.4. If you use the teximg plugin, +I recommend upgrading. |