teximg security problem

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 939d65d01e23830a597ec18c27290295be6735f7..ba3eac1874ccc7a151205e947aed1185932288ee 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -417,3 +417,13 @@ attack.
 intrigeri discovered this problem on 12 Nov 2008 and a patch put in place
 later that day, in version 2.70. The fix was backported to testing as version
 2.53.3, and to stable as version 1.33.7.
 intrigeri discovered this problem on 12 Nov 2008 and a patch put in place
 later that day, in version 2.70. The fix was backported to testing as version
 2.53.3, and to stable as version 1.33.7.

+
+## Insufficient blacklisting in teximg plugin
+
+Josh Tripplet discovered on 28 Aug 2009 that the teximg plugin's
+blacklisting of insecure TeX commands was insufficient; it could be
+bypassed and used to read arbitrary files. This was fixed by
+enabling TeX configuration options that disallow unsafe TeX commands.
+The fix was released on 30 Aug 2009 in version 3.1415926, and was
+backported to stable in version 2.53.4. If you use the teximg plugin,
+I recommend upgrading.