From 211e7fc6d34128d8cf69ffde731947946d43553a Mon Sep 17 00:00:00 2001 From: Seamus Lee Date: Wed, 1 May 2019 12:40:10 +1000 Subject: [PATCH] WIP Release Notes for security release Update Release notes based on Tim's Review and likely drop of 5.13.3 --- release-notes/5.13.4.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 release-notes/5.13.4.md diff --git a/release-notes/5.13.4.md b/release-notes/5.13.4.md new file mode 100644 index 0000000000..1222c72628 --- /dev/null +++ b/release-notes/5.13.4.md @@ -0,0 +1,22 @@ +# CiviCRM 5.13.4 + +Released May 15, 2019 + +- **[Security advisories](#security)** +- **[Features](#features)** +- **[Bugs resolved](#bugs)** +- **[Miscellany](#misc)** +- **[Credits](#credits)** + +## Security advisories + +- **[CIVI-SA-2019-09](https://civicrm.org/advisory/civi-sa-2019-09-xxe-in-phpword)** XXE in PHPWord +- **[CIVI-SA-2019-10](https://civicrm.org/advisory/civi-sa-2019-10-tcpdf-xss-and-rce-vulerabilities)** TcpDF XSS and RCE vulnerabilities +- **[CIVI-SA-2019-11](https://civicrm.org/advisory/civi-sa-2019-11-jquery-objectprototype-pollution)** JQuery Object.prototype pollution +- **[CIVI-SA-2019-12](https://civicrm.org/advisory/civi-sa-2019-12-sqli-in-building-country-state-or-county-options)** SQLI in building Country, State or County Options +- **[CIVI-SA-2019-13](https://civicrm.org/advisory/civi-sa-2019-13-harden-against-unsearlize-vulnerabilities)** Harden against unsearlize vulnerabilities +- **[CIVI-SA-2019-14](https://civicrm.org/advisory/civi-sa-2019-14-sqli-in-apiv3-getoptions)** SQLI in APIv3 GetOptions +- **[CIVI-SA-2019-15](https://civicrm.org/advisory/civi-sa-2019-15-xss-via-forged-mime-type)** XSS via forged MIME Type +- **[CIVI-SA-2019-16](https://civicrm.org/advisory/civi-sa-2019-16-sqli-in-certain-checkboxes)** SQLI in certain checkboxes +- **[CIVI-SA-2019-17](https://civicrm.org/advisory/civi-sa-2019-17-sqli-in-manage-events)** SQLI in "Manage Events" +- **[CIVI-SA-2019-18](https://civicrm.org/advisory/civi-sa-2019-18-xss-in-civicrm-installer)** XSS in CiviCRM installer -- 2.25.1