Changelog
11 security fixes in this release, including:
warn control = dkim_disable_verifyThis version contains three important security fixes, please upgrade immediately.
One ofË€ † † _€] †ž# ]t allows arbitrary users to modify privileges on a file server.
Security checks were incorrectly applied to the Local Security Authority (LSA) remote proceedure calls (RPC) CreateAccount, OpenAccoÑ † † r €q ±7 †|'q11-12-07
2012-01-26 Multiple format string vulnerabilities in the DCC functionality in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.
€g †ž# ~malicious web site4786CVE-2009-4787 CVE-2009-4788 †ž >An error when processing DTLS messages can be exploited to exhaust all available memory by sending a large number of out of sequence handshake messagý€ † † JÓ@€ †ž# Git maintainers report: gitweb has a possible local privilege ƒ † † _€] †ž# ]in a query and at the same time causing it to fail by submitting invalid data, an XSS hole can be exploited.
There is an XSS problem in the task history attached to comments, since the application fail‰À † † _€] †ž# ]as attack scenarios are very unlikely.
Various path fields are not escaped properly, thus filling them with javascript code will lead to XSS. MySQL error messages are not escaped, thus the databasà † † _€] †ž# ]o compromise a user's system.
- An array indexing error within the "DCTStream::readProgressiveDataUnit()" method in xpdf/Stream.cc can be exploited to corrupt memory via a specially c–€ † † _€] †ž# ]07/2336
Unspecified input passed to the private archive script is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and¯€ † † f€A ^‡?¤ [¢} †bAes="http://www.w3.org/1999/xhtml">
Announce of Mnemo H3 (2.0.379228172&w=2">
This [2.0.3µ † † €T D‚¸=€E †ž# /security/?id=20
Do not use the -N command line option on untrusted files and do not uncompress files in directories where untrusted users have write access.
Tavis Ormandy of the Gentoo Linux Security Audit Team identified a flaw in the handling of image filenames by xv.
Successful exploitation wouldÈ€ † † `€] J¬@‚ n¡= †i:_xzgv.html
The X11R6.8.1 release announcement reads: