However, that is currently only packaged in wip.
Add a comment about this for someone else to fix.
Add a comment about an upstream bug report for a test failure.
7.57 2017-11-18
- Fixed installation problems with some versions of Perl on Windows.
7.56 2017-11-14
- Added num check to Mojolicious::Validator.
- Improved built-in templates with high resolution logos.
Upstream changes (from NEWS):
== Ruby-GNOME2 3.2.1: 2017-11-19
This is a memory related bug fix release.
=== Changes
==== Ruby/GLib2
* Improvements
* (({GLib::Bytes#initialize})): Stopped to copy data for frozen
(({String})).
==== Ruby/GObjectIntrospection
* Fixes
* Fixed memory leaks for output parameters.
[GitHub#1113][Reported by Will Bryant]
==== Ruby/GIO2
* Improvements
* (({Gio::InputStream#read_all})): Made workable.
[GitHub#1110][Reported by Paul van Tilburg]
* (({Gio::InputStream#read})): If the given size is (({nil})),
read until EOF or error. It's compatible with Ruby's IO objects.
==== Ruby/GTK3
* Improvements
* Marked top-level windows automatically.
[GitHub#1103][Reported by cedlemo]
=== Thanks
* Paul van Tilburg
* cedlemo
* Will Bryant
2.3.3:
Having a ; in Response content type does not assume it contains a charset anymore.
Use getattr(asyncio, ‘async’) for keeping compatibility with Python 3.7.
Ignore NotImplementedError raised by set_child_watcher from uvloop.
Fix warning in ClientSession.__del__ by stopping to try to close it.
Fixed typo’s in Third-party libraries page. And added async-v20 to the list
Upstream changes:
MediaWiki 1.29.2
This is a security and maintenance release of the MediaWiki 1.29 branch.
Changes since 1.29.1
(T166757) Avoid scoped lock errors in Category::refreshCounts() due to nesting.
(T175439) Unbreak Postgres Updater when setting defaults for a column.
(T160298) Remove use of implicitGroupBy() in ActiveUsersPager.
Fixed login button label to accept RawMessage.
Fixed case of SpecialRecentChanges class usage.
(T174255) Declare uploadCount property in importDump.php.
(T163646) Pass a string not an int to mysql_real_escape_string().
(T180143) Bump justinrainbow/json-schema development dependency to ~5.2.
Updated dev dependancy phpunit/phpunit from v4.8.35 to v4.8.36.
(T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.
(T165846) SECURITY: BotPassword login attempts weren't throttled.
(T128209) SECURITY: Reflected File Download from api.php.
(T134100) SECURITY: Do not reveal if user exists during login failure.
(T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.
(T125163) SECURITY: Make anchor for headlines escape > and <.
(T180237) SECURITY: Protect vendor folder with .htaccess.
(T180231) SECURITY: Remove PHPUnit file with known RCE if exists in update.php.
(T124404) SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit.
(T119158) SECURITY: Handle -{}- syntax in attributes safely.
(T180488) (T125177) "api.log contains passwords in plaintext" wasn't correctly fixed in all branches in the previous security release.
3.4.7:
Features
* Implement exponents for numbers
* Implement long file path support for Windows
Fixes
* Error on quoted string in simple selector parsing
* Do not compress colors in selectors
* Fix issue when passing restargs to call
* Fix issue with attribute selector unification
* Improve wrapped pseudo selector handling
* Improve extend of wrapped pseudo selectors
* Fix propagation of named rest arguments
* Do not output invisible support blocks
* Various build makefile and CI related fixes
Upstream says:
You'll find below the changes of this bugfixes version:
- Rework mail attachments for notifications (inline images are now handled, ...),
- Fix ticket reopening,
- Fix operating system update on sub-entities,
- Fix issues on knowledge base items removal and display,
- Unset autoclose delay on fresh install,
- Improve private saved searches (with entities),
- Fix carriage return issues on tickets,
- Fix massive actions on operating systems,
- Fix migration issues from 9.1 and 9.2,
- Add support for other cache methods than APCu,
- Fix linear amortize calculation,
- Fix mail collector attachments owner,
- And many more!
Full ChangeLog:
<https://github.com/glpi-project/glpi/milestone/21?closed=1>
Upstream changes:
Highlights
MDL-59798 - Assignment: Show Due Date in calendar for teachers and managers
MDL-36580 - External Tool: backup/restore consumer key and secret (on the same site only)
MDL-57560 - Show file upload progress bar in Boost theme
MDL-37810 - List custom roles in the filter on Participants page
Security issues
A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
Fixes and improvements
MDL-52131 - Respect comment format in questions manual comments when Plain text area editor is used
MDL-55849 - Assignment: Reopening a group assignment should not create additional attempts for each group member
MDL-59909 - Fixed error in ad-hoc refresh_mod_calendar_events_task that caused exceptions and very long cron run time
MDL-59780 - Restore MathJax filter settings that were lost in previous upgrades
MDL-54540 - External tool: Allow to switch to full screen mode
MDL-51892 - Better explaination of the reason for failed logins in the logs report
MDL-57055 - Label resource: allow to access "Label administration" without Administration block on the "Edit label" page
MDL-53244 - Show error message when incorrect CAPTCHA is entered on sign-up page
MDL-57477 - Fixed configuration of PHP 7 sessions using memcached (3.x.x)
MDL-59854 - Forum: Avoid creating duplicate subscriptions due to race conditions
MDL-60366 - Feedback: fixed upgrade script (introduced in 3.1.6 and 3.2.3) that deleted valid multiple anonymous attempts. If your site was affected, please follow MDL-60592 for the script that restores accidentally deleted data.
Changelog:
Security fixes:
#CVE-2017-7828: Use-after-free of PressShell while restyling layout
Reporter
Nils
Impact
critical
Description
A use-after-free vulnerability can occur when flushing and resizing
layout because the PressShell object has been freed while still
in use. This results in a potentially exploitable crash during
these operations.
References
Bug 1406750
Bug 1412252
#CVE-2017-7830: Cross-origin URL information leak through Resource Timing API
Reporter
Jun Kokatsu
Impact
high
Description
The Resource Timing API incorrectly revealed navigations in cross-origin
iframes. This is a same-origin policy violation and could allow for
data theft of URLs loaded by users.
References
Memory safety bugs fixed in Firefox 57
#CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5
Reporter
Mozilla developers and community
Impact
critical
Description
Mozilla developers and community members Christian Holler, David
Keeler, Jon Coppeard, Julien Cristau, Jan de Mooij, Jason Kratzer,
Philipp, Nicholas Nethercote, Oriol Brufau, André Bargull, Bob Clary,
Jet Villegas, Randell Jesup, Tyson Smith, Gary Kwong, and Ryan VanderMeulen
reported memory safety bugs present in Firefox 56 and Firefox ESR 52.4.
Some of these bugs showed evidence of memory corruption and we presume
that with enough effort that some of these could be exploited to
run arbitrary code.
References
Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5
Changelog: New
A completely new browsing engine, designed to take full advantage
of the processing power in modern devices
A redesigned interface with a clean, modern appearance, consistent
visual elements, and optimizations for touch screens
A unified address and search bar. New installs will see this
unified bar. Learn how to add the stand-alone search bar to
the toolbar
A revamped new tab page that includes top visited sites, recently
visited pages, and recommendations from Pocket (in the US,
Canada, and Germany)
An updated product tour to orient new and returning Firefox
users
AMD VP9 hardware video decoder support for improved video
playback with lower power consumption
An expanded section in preferences to manage all website
permissions
Fixed
Various security fixes
Changed
Firefox now exclusively supports extensions built using the
WebExtension API, and unsupported legacy extensions will no
longer work. Learn more about our efforts to improve the
performance and security of extensions
The browser's autoscroll feature, as well as scrolling by
keyboard input and touch-dragging of scrollbars, now use
asynchronous scrolling. These scrolling methods are now similar
to other input methods like mousewheel, and provide a smoother
scrolling experience
The content process now has a stricter security sandbox that
blocks filesystem reading and writing on Linux, similar to the
protections for Windows and macOS that shipped in Firefox 56
Middle mouse paste in the content area no longer navigates to
URLs by default on Unix systems
Removed the toolbar Share button. If you relied on this feature,
you can install the Share Backported extension instead.
Some older versions of the ATOK IME, including ATOK 2006, 2008,
2009 and 2010, can cause crashes and are therefore disabled on
the Windows 64-bit version of Firefox Quantum. To fix those
incompatibility issues, please use a newer version of ATOK or
one of other IMEs.
The default font for Japanese text is now Meiryo
Security fixes:
CVE-2017-7828: Use-after-free of PressShell while restyling layout
Reporter
Nils
Impact
critical
Description
A use-after-free vulnerability can occur when flushing and resizing
layout because the PressShell object has been freed while still in
use. This results in a potentially exploitable crash during these
operations.
References
Bug 1406750 Bug 1412252
#CVE-2017-7830: Cross-origin URL information leak through Resource
Timing API
Reporter
Jun Kokatsu
Impact
high
Description
The Resource Timing API incorrectly revealed navigations in
cross-origin iframes. This is a same-origin policy violation and
could allow for data theft of URLs loaded by users.
References
Bug 1408990
#CVE-2017-7831: Information disclosure of exposed properties on
JavaScript proxy objects
Reporter
Oriol Brufau
Impact
moderate
Description
A vulnerability where the security wrapper does not deny access to
some exposed properties using the deprecated exposedProps mechanism
on proxy objects. These properties should be explicitly unavailable
to proxy objects.
References
Bug 1392026
#CVE-2017-7832: Domain spoofing through use of dotless 'i' character
followed by accent markers
Reporter
Jonathan Kew
Impact
moderate
Description
The combined, single character, version of the letter 'i' with any
of the potential accents in unicode, such as acute or grave, can
be spoofed in the addressbar by the dotless version of 'i' followed
by the same accent as a second character with most font sets. This
allows for domain spoofing attacks because these combined domain
names do not display as punycode.
References
Bug 1408782
#CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker
characters
Reporter
Rayyan Bijoora
Impact
moderate
Description
Some Arabic and Indic vowel marker characters can be combined with
Latin characters in a domain name to eclipse the non-Latin character
with some font sets on the addressbar. The non-Latin character will
not be visible to most viewers. This allows for domain spoofing
attacks because these combined domain names do not display as
punycode.
References
Bug 1370497
#CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections
Reporter
Jordi Chancel
Impact
moderate
Description
A data: URL loaded in a new tab did not inherit the Content Security
Policy (CSP) of the original page, allowing for bypasses of the
policy including the execution of JavaScript. In prior versions
when data: documents also inherited the context of the original
page this would allow for potential cross-site scripting (XSS)
attacks.
References
Bug 1358009
#CVE-2017-7835: Mixed content blocking incorrectly applies with
redirects
Reporter
Ben Kelly
Impact
moderate
Description
Mixed content blocking of insecure (HTTP) sub-resources in a secure
(HTTPS) document was not correctly applied for resources that
redirect from HTTPS to HTTP, allowing content that should be blocked,
such as scripts, to be loaded on a page.
References
Bug 1402363
#CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and
OS X
Reporter
Ezra Caltum
Impact
moderate
Description
The "pingsender" executable used by the Firefox Health Report
dynamically loads a system copy of libcurl, which an attacker could
replace. This allows for privilege escalation as the replaced
libcurl code will run with Firefox's privileges. Note: This attack
requires an attacker have local system access and only affects OS
X and Linux. Windows systems are not affected.
References
Bug 1401339
#CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies
Reporter
Jun Kokatsu
Impact
moderate
Description
SVG loaded through <img> tags can use <meta> tags within the SVG
data to set cookies for that page.
References
Bug 1325923
#CVE-2017-7838: Failure of individual decoding of labels in
international domain names triggers punycode display of entire IDN
Reporter
Corey Bonnell
Impact
low
Description
Punycode format text will be displayed for entire qualified
international domain names in some instances when a sub-domain
triggers the punycode display instead of the primary domain being
displayed in native script and the sub-domain only displaying as
punycode. This could be used for limited spoofing attacks due to
user confusion.
References
Bug 1399540
#CVE-2017-7839: Control characters before javascript: URLs defeats
self-XSS prevention mechanism
Reporter
Eric Lawrence
Impact
low
Description
Control characters prepended before javascript: URLs pasted in the
addressbar can cause the leading characters to be ignored and the
pasted JavaScript to be executed instead of being blocked. This
could be used in social engineering and self-cross-site-scripting
(self-XSS) attacks where users are convinced to copy and paste text
into the addressbar.
References
Bug 1402896
#CVE-2017-7840: Exported bookmarks do not strip script elements
from user-supplied tags
Reporter
Hanno Bock
Impact
low
Description
JavaScript can be injected into an exported bookmarks file by
placing JavaScript code into user-supplied tags in saved bookmarks.
If the resulting exported HTML file is later opened in a browser
this JavaScript will be executed. This could be used in social
engineering and self-cross-scripting (self-XSS) attacks if users
were convinced to add malicious tags to bookmarks, export them,
and then open the resulting file.
References
Bug 1366420
#CVE-2017-7842: Referrer Policy is not always respected for <link>
elements
Reporter
Jun Kokatsu
Impact
low
Description
If a document's Referrer Policy attribute is set to "no-referrer"
sometimes two network requests are made for <link> elements
instead of one. One of these requests includes the referrer instead
of respecting the set policy to not include a referrer on requests.
References
Bug 1397064
#CVE-2017-7827: Memory safety bugs fixed in Firefox 57
Reporter
Mozilla developers and community
Impact
critical
Description
Mozilla developers and community members Boris Zbarsky, Carsten Book,
Christian Holler, Byron Campen, Jan de Mooij, Jason Kratzer,
Jesse Schwartzentruber, Marcia Knous, Randell Jesup, Tyson Smith,
and Ting-Yu Chou reported memory safety bugs present in Firefox 56.
Some of these bugs showed evidence of memory corruption and we presume
that with enough effort that some of these could be exploited to run
arbitrary code.
References
Memory safety bugs fixed in Firefox 57
#CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox
ESR 52.5
Reporter
Mozilla developers and community
Impact
critical
Description
Mozilla developers and community members Christian Holler, David
Keeler, Jon Coppeard, Julien Cristau, Jan de Mooij, Jason Kratzer,
Philipp, Nicholas Nethercote, Oriol Brufau, André Bargull, Bob
Clary, Jet Villegas, Randell Jesup, Tyson Smith, Gary Kwong, and
Ryan VanderMeulen reported memory safety bugs present in Firefox
56 and Firefox ESR 52.4. Some of these bugs showed evidence of
memory corruption and we presume that with enough effort that some
of these could be exploited to run arbitrary code.
References
Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5
# Contao core bundle change log
### 4.4.8 (2017-11-15)
* Prevent SQL injections in the back end search panel (see CVE-2017-16558).
* Support class named services in System::import() and System::importStatic()
(see #1176).
* Only show pretty error screens on Contao routes (see #1149).
# Contao listing bundle change log
### 4.4.8 (2017-11-15)
* Prevent SQL injections in the listing module (see CVE-2017-16558).
0.14.2:
Restore strict parameter as no-op in quote/unquote
0.14.1:
Restore strict parameter as no-op for sake of compatibility with aiohttp 2.2
0.14.0:
Drop strict mode
Fix “ValueError: Unallowed PCT %” when there’s a “%” in the url
Changelog:
Based on Firefox 52.4.1
SeaMonkey-specific changes
SeaMonkey should no longer crash when you start it or try to use the mail feature on OS X 10.12 or greater.
You were not always prompted for authentication in SeaMonkey 2.48 under certain scenarios resulting in login failures. The problem, tracked in bug 1347857, has been fixed.
Mail and News: The way images are included in a compose window has changed. Images are now included as data URIs and not as references to parts of other messages or operating system files. This allows better interoperability with office packages such as MS Office or LibreOffice. Images linked from locations on the internet will no longer be downloaded and attached to the message automatically. This can be changed globally by setting the preference mail.compose.attach_http_images.
Language support for nb-NO has been re-added.
SeaMonkey now uses gtk3 on Linux. If you experience a problem because of this please file a bug and link it to Switch Linux builds to GTK3 with SeaMonkey 2.49. Pleae try another OS theme first. Some of them are buggy and cause problems with SeaMonkey, Thunderbird and Firefox.
Quotes are now colored differently in Mails bug 1374708.
Under OSX the left panes in Bookmarks Manager, MailNews and Address Book are now styled like finder panes. See bug 1095904.
Quotes are now colored differently in Mails up to 5 levels deep depending on your OS. See bug 1374708. This may break custom themes for email composition because a new style sheet named "messageQuotes.css" has been added.
6.29 2017-11-06
- Fix some version numbers
6.28 2017-11-06
- Remove last use of Geopt::Std (Sergey Remanov) (GH #267)
- Include unmatched connect error in status string (Patrik Lundin) (GH #269)
- Fix insecure open FILEHANDLE,EXPR (Takumi Akiyama) (GH #270)
0.18 2017-11-03T15:01:43Z
- Added URI::redshift to support db:redshift: URIs, thanks to a pull
request from Steve Caldwell (PR #12).
- Added URI::exasol, thanks to Johan Wärlander.
7.55 2017-11-06
- Added -role flag to Mojo::Base. (jberger)
- Improved tablify function in Mojo::Util to work with non-rectangular arrays.
(CandyAngel, jabberwok)
- Improved Windows compatibility of Mojo::Server::Daemon.
7.54 2017-11-05
- Fixed a bug in Mojo::Promise where promise chains could not recover from
rejections.
7.53 2017-11-04
- Added module Mojo::Promise.
- Improved Mojo::IOLoop::Delay to be a subclass of Mojo::Promise.
7.52 2017-11-02
- Added delete_p, get_p, head_p, options_p, patch_p, post_p, put_p and start_p
methods to Mojo::UserAgent.
7.51 2017-10-31
- Added -signatures flag to Mojo::Base and Mojolicious::Lite.
- Added support for new HTTP status code.
- Improved ojo to enable subroutine signatures automatically on Perl 5.20+.
7.50 2017-10-30
- Deprecated error and finish events in Mojo::IOLoop::Delay. Since there is no
good way to warn our users about this deprecation, it will be in effect
until the next major release. Where we will also change the base class from
Mojo::EventEmitter to Mojo::Base.
- Improved documentation browser with links to MetaCPAN.
7.49 2017-10-28
- Deprecated Mojo::IOLoop::Delay::data and Mojo::IOLoop::Delay::remaining.
- Added Promises/A+ support. Note that Mojo::IOLoop::Delay previously
inherited a catch method from Mojo::EventEmitter that was passed the error
message as second argument instead of the first, so you might have to change
$delay->catch(sub { my ($delay, $error) = @_; ... });
to
$delay->catch(sub { my ($error) = @_; ... });
- Added all, catch, finally, race and then methods to Mojo::IOLoop::Delay.
- Updated jQuery to version 3.2.1.
0.14 Sat, 28 Oct 2017 14:53:00 +0100
- Further improvements to the path handling to fix a bug with
specifying the base directory using a relative path. Closes:
https://rt.cpan.org/Public/Bug/Display.html?id=123428
Geckodriver provides the HTTP API described by the W3C WebDriver protocol to
communicate with Gecko browsers, such as Firefox. It translates calls into
the Firefox remote protocol by acting as a proxy between the local- and remote
ends. This is used by browser automation frameworks such as Selenium.
Version 3.7.3:
Fix AppRegistryNotReady error importing contrib.auth views
Version 3.7.2:
Fixed Django 2.1 compatibility due to removal of django.contrib.auth.login()/logout() views.
Add missing import for TextLexer.
Adding examples and documentation for caching
Include date and date-time format for schema generation
Use triple backticks for markdown code blocks
Interactive docs - make bottom sidebar items sticky
Clarify pagination system check
Stop JSONBoundField mangling invalid JSON
Have JSONField render as textarea in Browsable API
Schema: Exclude OPTIONS/HEAD for ViewSet actions
Fix ordering for dotted sources
Fix: Fields with allow_null=True should imply a default serialization value
Ensure Location header is strictly a 'str', not subclass.
Add import to example in api-guide/parsers
Catch OverflowError for "out of range" datetimes
Add djangorestframework-rapidjson to third party packages
Increase test coverage for drf_create_token command
Add trove classifier for Python 3.6 support.
Add pip cache support to the Travis CI configuration
Rename [wheel] section to [bdist_wheel] as the former is legacy
Fix invalid escape sequence deprecation warnings
Add interactive docs error template
Add rounding parameter to DecimalField
Fix all BytesWarning caught during tests
Use dict and set literals instead of calls to dict() and set()
Change ImageField validation pattern, use validators from DjangoImageField
Fix processing unicode symbols in query_string by Python 2
5.2.1
Add more border width to codemirror cursor.
Fix nbconvert handler.
Fix the prompt_area argument of the output area constructor.
Handle a compound extension in new_untitled.
Allow disabling offline message buffering
Drupal is a free web Content Management System (CMS) that allows an
individual or a community of users to easily publish, manage and organize a
wide variety of content on a website.
Drupal is ready to go from the moment you download it. It even has an
easy-to-use web installer! The built-in functionality, combined with dozens
of freely available add-on modules, will enable features such as: Content
Management Systems, Blogs, Collaborative authoring environments, Forums,
Peer-to-peer networking, Newsletters, Podcasting, Picture galleries, File
uploads/downloads and much more.
