Fwd: xxxx-11-25: International Day for the Elimination of Violence against Women 2017-11-25 No Comments

November 25: International Day for the Elimination of Violence against Women
(Wikipedia)

Fwd: Bit-squatting: DNS Hijacking Without Exploitation No Comments

Not new at all but was new to me, and was well worth my time:

DEFCON 19: Bit-squatting: DNS Hijacking Without Exploitation (w speaker)

Only somewhat related: https://www.pytosquatting.org/

Expat 2.2.5 released 2017-11-01 No Comments

Expat 2.2.5 has recently been released. It fixes miscellaneous bugs. For more details, please check the changelog.

If you maintain Expat packaging or a bundled version of Expat somewhere, please update to 2.2.5. Thanks!

Sebastian Pipping

GIMP 2.9.6 now in Gentoo 2017-08-26 No Comments

Here’s what upstream has to say about the new release 2.9.6. Enjoy 🙂

Expat 2.2.4 released 2017-08-23 No Comments

Expat 2.2.4 has recently been released. It features one major bugfix regarding files encoded as UTF-8, and improvements to the build system.

If you are using a more ancient version of Visual Studio like 2012, please check the post-2.2.4 commits in Git for related fixes to compilation.

Also, founding of Rhodri’s work on Expat by the Core Infrastructure Initiative is coming to an end. If you can fund additional developers for work on Expat — including smooth integration of by-default protection against billion laughs denial-of-service attacks — please get in touch.

Sebastian Pipping

Openmailbox.org turns against existing users, drops IMAP support without prior notice 2017-08-06 No Comments

Update: I moved to disroot.org now.

Expat 2.2.3 released, includes security fixes for Windows 2017-08-02 No Comments

Just a quick note that Expat 2.2.3 has been released. For Windows users, it fixes DLL hijacking (CVE-2017-11742). On Linux, extracting entropy for Hash DoS protection no longer blocks, which affected D-Bus and systems that are low on entropy early in the boot process. For more details, please check the change log.

Expat 2.2.2 released 2017-07-14 No Comments

(This article first appeared on XML.com.)

A few weeks after release 2.2.1 of the free software XML parsing library Expat, version 2.2.2 now improves on few rough edges (mostly related to compilation) but also fixes security issues.

Windows binaries compiled with _UNICODE now use proper entropy for seeding the SipHash algorithm. On Unix-like platforms, accidentally missing out on high quality entropy sources is now prevented from going unnoticed: It would happen when some other build system than the configure script was used, e.g. the shipped CMake one or when the source code was copied into some parent project’s build system without paying attention to the new compile flags (that the configure script would auto-detect for you). After some struggle with a decision about C99, Expat requires a C99 compiler now; 18 years after its definition, that’s a defendable move. The uint64_t type and ULL integer literals (unsigned long long) for SipHash made us move.

Expat would like to thank the community for the bug reports and patches that went into Expat 2.2.2. If you maintain a bundled copy of Expat somewhere, please make sure it gets updated.

Sebastian Pipping
for the Expat development team

Expat 2.2.1 with security fixes has been released 2017-06-18 No Comments

Expat 2.2.1 has been released. It’s a security release with a variety of security fixes, for instance: An infinite loop denial-of-service fix (that Rhodri James wrote more about), introduction of SipHash against sophisticated hash flooding, use of OS-specific high quality entropy providers like getrandom, integer overflow fixes, and more. We also got better code coverage, moved all but the downloads from SourceForge to GitHub, … but maybe have a look at the detailed change log yourself 🙂

So if you control copies of Expat somewhere, please get them updated.

Let me use the occasion to point out that we are looking for help with a few things Expat. There are tickets with details up here. If you can help, please get in touch.

Thanks and best

 

Sebastian

Fwd: Issues with window.opener (HTML, not just JavaScript) 2017-06-11 No Comments

About rel=noopener (mathiasbynens.github.io)