diff options
Diffstat (limited to 'Build/source/texk/kpathsea/ChangeLog')
| -rw-r--r-- | Build/source/texk/kpathsea/ChangeLog | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog index dc1bd95adf3..6c09d3e1393 100644 --- a/Build/source/texk/kpathsea/ChangeLog +++ b/Build/source/texk/kpathsea/ChangeLog @@ -1,3 +1,32 @@ +2024-11-06 Karl Berry <karl@freefriends.org> + + * tex-file.c (kpathsea_name_ok): don't allow writing to the + filename ".tex". LaTeX 2024-11-01 changes their build process so + their .tex file is not created from TeX. Although maybe not + technically a security problem, it feels better not to allow it. + Report from Nicola Talbot, tlsecurity May 24 13:48:16 CEST 2024. + * NEWS: mention this. + * doc/kpathsea.texi (Safe filenames): remove doc of special case. + +2024-09-25 Karl Berry <karl@tug.org> + + * texmf.cnf (shell_escape_commands): add latexminted for minted 3.0, + after various reviews via tlsecurity, etc. + +2024-08-19 Karl Berry <karl@freefriends.org> + + * tex-file.c (kpathsea_name_ok) <not_ok>: avoid spurious double space + in message. + +2024-07-01 Karl Berry <karl@tug.org> + + * texmf.cnf (shell_escape_commands): restore extractbb, + now as a wrapper script that protects against the exploit. + +2024-06-29 Karl Berry <karl@tug.org> + + * texmf.cnf (shell_escape_commands): remove extractbb. + 2024-06-04 Karl Berry <karl@freefriends.org> * texmf.cnf (MKTEXPK, etc.): adjust values shown to the |