Fix changelog.

This commit is contained in:
2025-12-18 20:04:34 +01:00
parent 7a848baf56
commit 66da58370e

View File

@@ -4,7 +4,7 @@ Thu Dec 11 17:37:09 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
* Update to 3.14.2: * Update to 3.14.2:
- Security - Security
- gh-142145: Remove quadratic behavior in xml.minidom node ID - gh-142145: Remove quadratic behavior in xml.minidom node ID
cache clearing. cache clearing (CVE-2025-12084, bsc#1254997).
- gh-119452: Fix a potential memory denial of service in the - gh-119452: Fix a potential memory denial of service in the
http.server module. When a malicious user is connected to the http.server module. When a malicious user is connected to the
CGI server on Windows, it could cause an arbitrary amount of CGI server on Windows, it could cause an arbitrary amount of
@@ -66,10 +66,10 @@ Thu Dec 11 17:37:09 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
- gh-139700: Check consistency of the zip64 end of central - gh-139700: Check consistency of the zip64 end of central
directory record. Support records with “zip64 extensible directory record. Support records with “zip64 extensible
data” if there are no bytes prepended to the ZIP file. data” if there are no bytes prepended to the ZIP file.
(CVE-2025-8291, bsc#1251305)
- gh-139283: sqlite3: correctly handle maximum number of rows - gh-139283: sqlite3: correctly handle maximum number of rows
to fetch in Cursor.fetchmany and reject negative values for to fetch in Cursor.fetchmany and reject negative values for
Cursor.arraysize. Patch by Bénédikt Tran. (CVE-2025-8291, Cursor.arraysize. Patch by Bénédikt Tran.
bsc#1251305)
- gh-137836: Add support of the “plaintext” element, RAWTEXT - gh-137836: Add support of the “plaintext” element, RAWTEXT
elements “xmp”, “iframe”, “noembed” and “noframes”, and elements “xmp”, “iframe”, “noembed” and “noframes”, and
optionally RAWTEXT element “noscript” in optionally RAWTEXT element “noscript” in