Editor: A security vulnerability has been discovered in DMDirc. The implementation of URL handlers allow specially crafted URLs to execute arbitrary programs on the host system. Only custom URL handlers (those listed as "custom commands" in the 'URL Handlers' section of the preferences panel) are vulnerable, and the user has to click on a malicious URL in order for the vulnerability to be exploited.
DMDirc 0.6.3m1 is one of our 鈥渕ilestone鈥?releases of the 0.6.3 branch. These milestone releases were a (somewhat failed) attempt to release more often than we have in the past. We periodically decide to stop working on any new features and tidy up the current code-base into a release-ready state to allow users of the stable branch of the client to get some of the new features and fixes we have added sooner than having to wait for a full major release. It鈥檚 taken us almost a year to get to 0.6.3m1, so imagine how long it鈥檇 take if we went straight to 0.6.3 itself (which is approximately two Milestones away)!
Users of previous versions of DMDirc should in the coming days be prompted by the automatic updater (if enabled) to update to the latest version of DMDirc. Alternatively, you can visit our downloads page to grab the latest version yourself.
With DMDirc 0.6.3m1 released we are now looking forward to our next milestone release, DMDirc 0.6.3m2. So far the issue list for this contains exciting additions such as improved handling of different charsets in channels, additional changes to plugins to try and make them less like black magic, server lists, improved support for netbooks (and other low-resolution systems), and a plethora of other bug fixes and general improvements to make the client nicer to use.
