From 6bd91573cebd1e4ee954ebd4eb6db5b654e0e412 Mon Sep 17 00:00:00 2001 From: Alexey Sokolov Date: Sun, 13 Sep 2026 09:05:34 +0100 Subject: [PATCH] Increase the version number to 1.10.3 --- CMakeLists.txt | 6 +++--- ChangeLog.md | 28 ++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+), 3 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 0993c7fb..25979a76 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -15,9 +15,9 @@ # cmake_minimum_required(VERSION 3.13) -project(ZNC VERSION 1.10.2 LANGUAGES CXX) -set(ZNC_VERSION 1.10.x) -set(append_git_version true) +project(ZNC VERSION 1.10.3 LANGUAGES CXX) +set(ZNC_VERSION 1.10.3) +set(append_git_version false) set(alpha_version "") # e.g. "-rc1" set(VERSION_EXTRA "" CACHE STRING "Additional string appended to version, e.g. to mark distribution") diff --git a/ChangeLog.md b/ChangeLog.md index f858646b..a8246ab0 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -1,3 +1,31 @@ +# ZNC 1.10.3 (2026-09-13) + +This is a security release to fix the following issues: + +## CVE-2026-82373 + +Use-after-free when unloading modules, triggered by unprivileged users. + +Note that the fix required a slight API change for `OnEmbeddedWebRequest`: +now the callers (webadmin is the only known caller of it) call it via +`DoEmbeddedWebRequest()` instead. The modules which implement this hook +need no changes. + +To mitigate, set `DenyLoadMod` to true. + +Found by Claude from Anthropic, reported by Ada Logics. + +## CVE-2026-82374 + +Null pointer dereference in crypt module, triggered by IRC server. + +Found and fixed by KindOne. + +## CVE-2020-11022, CVE-2020-11023 + +Updated the old bundled vulnerable version of jQuery to 3.5.1. + + # ZNC 1.10.2 (2026-05-07) ## Fixes