commit ae439017e6979139aaafb46330a88033e02197c1
Author: Richard Kimberly Heck <[email protected]>
Date: Tue Jul 28 11:02:55 2026 -0400
Status
---
status.25x | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/status.25x b/status.25x
index 10df9df0e3..3803f0fe4d 100644
--- a/status.25x
+++ b/status.25x
@@ -13,6 +13,30 @@ What's new
** Updates:
***********
+* SECURITY HARDENING FIXES
+
+- Load-triggered arbitrary command execution vulnerabilities fixes:
+ - 00a: kpsewhich shell injection via filename
+ - 00b: lyx2lyx shell injection via filename
+ - 00c: graphics-extension name shell injection
+ - 00h: import-path filename shell injection into converters
+
+- Export/View triggered arbitrary command execution vulnerabilities fixes:
+ - 00d: bibtex command shell injection
+ - 00e: index command shell injection
+ - 00g: mangled filenames shell injection
+ - 00i: convert-pdf helper shell injection
+ - 00k: paperwidth/height injection causing arbitrary files rewrite
+
+- New consent authorization gate for unpatched external tools
+ - 00de: processing gate prompts before running a code-capable bib/index
tools
+ (biber/xindy/xindex) on an untrusted document,
+ The real fixes are upstream (biber 2.22, xindex 1.07, xindy from
up-to-date
+ TL tree), while the gate is LyX's interim guard.
+ For biber 2.22 the gate automatically relaxes to no-op.
+ - 00de-2: xindex version check relaxing the gate above.
+
+
* DOCUMENT INPUT/OUTPUT
- Issue an error on @ catcode mismatch by layout definitions (bug 13275)
--
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs
