diff options
| -rw-r--r-- | doc/security.mdwn | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/doc/security.mdwn b/doc/security.mdwn index 823f5ef88..56b648122 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -547,7 +547,7 @@ for sites where an untrusted user is able to attach files with arbitrary names and/or run a setuid ikiwiki wrapper with a working directory of their choice. -## Editing restriction bypass for git revert +## <span id="cve-2016-9645">Editing restriction bypass for git revert</span> intrigeri discovered that a web or git user could revert a change to a page they are not allowed to edit, if the change being reverted was made @@ -571,7 +571,7 @@ A backport to Debian 8 'jessie' is in progress. [[!cve CVE-2016-9645]]/OVE-20161226-0002 represents the vulnerability in 3.20161219 caused by the incomplete fix.) -## Commit metadata forgery via CGI::FormBuilder context-dependent APIs +## <span id="cve-2016-9646">Commit metadata forgery via CGI::FormBuilder context-dependent APIs</span> When CGI::FormBuilder->field("foo") is called in list context (and in particular in the arguments to a subroutine that takes named |