This is a security release that mainly addresses CVE-2023-43115. Our security advisory follows:

In Dangerzone, a security vulnerability was detected in the quarantined environment where documents are opened. Vulnerabilities like this are expected and do not compromise the security of Dangerzone. However, in combination with another more serious vulnerability (also called container escape), a malicious document may be able to breach the security of Dangerzone. We are not aware of any container escapes that affect Dangerzone. To reduce that risk, you are strongly advised to update Dangerzone to the latest version.

Summary

A security vulnerability in GhostScript (CVE-2023-43115) affects the contained environment where the document rendering takes place. If one attempts to convert a malicious file with an embedded PostScript image, arbitrary code may run within that environment. Such files look like regular Office documents, which means that you cannot avoid a specific extension. Other programs that open Office documents, such as LibreOffice, are also affected, unless the system has been upgraded in the meantime.

How does this impact me?

The expectation is that malicious code will run in a container without Internet access, meaning that it won't be able to infect the rest of the system.

What do I need to do?

You are strongly advised to update your Dangerzone installation to 0.5.1 as soon as possible.

Please note that we have recently enabled security scans for our software, and we aim to alert people even sooner about vulnerabilities like these.

On other news, this release brings some Qubes related fixes (see our security advisory), and an improvement in the update check UI, courtesy of our second-time contributor @garrettr.

For a full list of the changes, see our changelog.