[lyx-announce] SECURITY RELEASE: LyX 2.5.2

Public release of LyX version 2.5.2
===================================

We are pleased to announce the release the LyX 2.5.2, the second maintenance
release in the 2.5.x series.

This release is somewhat special. Apart from usual bag of bugfixes we also
include number of fixes to vulnerabilities dicovered in cooperation with AI
tools.

We STRONGLY urge all our users to upgrade from previous releases,
especiallyif they routinely use or exchange .lyx documents with external
parties. In previous versions of LyX, malformed .lyx documents can cause
arbitrary execution of shell commands upon .lyx load or within export
processing.

As the capabilities of frontier AI models quickly develop this might not
be the last such release and we suggest that users employ extreme caution
when dealing with files from untrusted sources. And not just with LyX. The
sort of vulnerability we discovered is likely present in many other 
programs.

In fact, some of the vulnerabilities depend upon bugs in tools LyX uses on
export. Those programs will be releasing their own fixes separately. LyX 
now
includes a 'security gate' that will warn you about the dangers if you 
are using
an older version of these tools.

This release also fixes a number of mostly minor bugs in 2.5.1. One 
important
fix solves the regression introduced in 2.5.1 which caused LyX not to 
store Qt
session configuration (e.g. size and position of windows).

If you think you may have found a bug in LyX 2.5.2, either email the 
developers'
mailing list (lyx-devel at lists.lyx.org), or open a bug report at
   https://www.lyx.org/trac/wiki/BugTrackerHome
Please specify if the behavior you are reporting is different from 
behavior in
a previous LyX version. Please note that we have had to disable registration
for new accounts due to spam. If you would like an account, email the LyX
developers' list.

If you have trouble using LyX or have a question, consult the documentation
that comes with LyX (under Help) and the LyX wiki, which you will find at
https://wiki.lyx.org/. You can also send email to the LyX users' list
(lyx-users at lists.lyx.org).

The LyX team.
https://www.lyx.org


What's new
==========

** Updates:
***********

* SECURITY HARDENING FIXES

- Load-triggered arbitrary command execution vulnerabilities fixes:
    - 00a: kpsewhich shell injection via filename
    - 00b: lyx2lyx shell injection via filename
    - 00c: graphics-extension name shell injection
    - 00h: import-path filename shell injection into converters

- Export/View triggered arbitrary command execution vulnerabilities fixes:
    - 00d: bibtex command shell injection
    - 00e: index command shell injection
    - 00g: mangled filenames shell injection
    - 00i: convert-pdf helper shell injection
    - 00k: paperwidth/height injection causing arbitrary files rewrite

- New consent authorization gate for unpatched external tools
   - 00de:  processing gate prompts before running a code-capable 
bib/index tools
            (biber/xindy/xindex) on an untrusted document,
            The real fixes are upstream (biber 2.22, xindex 1.07, xindy 
from up-to-date
            TL tree), while the gate is LyX's interim guard.
            For biber 2.22 the gate automatically relaxes to no-op.
   - 00de-2: xindex version check relaxing the gate above.


* DOCUMENT INPUT/OUTPUT

- Issue an error on @ catcode mismatch by layout definitions (bug 13275)


* MISCELLANEOUS

- LyX now supports the Elsevier CAS classes.

* TEX2LYX IMPROVEMENTS

- Add support for \colorlet if the second arg is a known LaTeX or custom
   color (bug 13310).


* USER INTERFACE

- Implement LFUN_REFERENCE_TO_PARAGRAPH for mathed (bug 13206).

- It is now possible in the tabular creation dialog (Inset > Table) to
   insert a multi-page table (optionally with caption) directly.

- Simple search within selection now remembers the initial selection
   beyond the first match (bug 13293).

- Fix session information not being properly restored. This regression
   introduced was introduced in 2.5.1 as a side effect of fixing macOS
   crash on exit and new fix should fix both issues.


* BUILD/INSTALLATION

- Use inkscape as fallback png->eps converter if ImageMagick is not
   available or IM policy does not allow for png->eps conversion.



** Bug fixes:
*************

* DOCUMENT INPUT/OUTPUT

- Fix problem with nesting of languages.

- Fix closing of local CJK language with polyglossia (bug 13315).

- Prevent duplicate theorem definitions (bug 13302).

- Fix case where the colortbl package has been loaded unnecessarily
   (bug 13306).

- Fix order of theorem definitions for pandoc processing (bug 13307).

- Fix support for import/export of ODT documents using pandoc.


* USER INTERFACE

- Fix crash when selecting inset (bug 13294).

- Fix assertion when closing buffer with listings settings dialog open.

- Consider longtable caption when adding new column (bug 13299).

- Load externally referred buffers and initialize their labels.

- Fix pasting of cross-references in math (bug 13290).

- Fix pasting from LaTeX with keepEmpty environment in first paragraph
   (bug 13295).

- Fix casing of strings in English localization (bug 13304).

- Fix background color drawing for non-center aligned tabular cells.

- Fix on-screen representation of "pagewidth" length (bug 13309).

- Fix sorting of colors in preferences.

- Fix zoom-in/out functions so that the inverse (e.g. with the mouse wheel)
   end up at the exact same value (bug 13327).


* TEX2LYX

- Fix import of table with linebreak in column specification.

- Fix parsing of more complex column specification.

- Error if TeX file has a preamble but no (accessible) \begin{document}
   (bug 13297).

-- 
lyx-announce mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-announce