Advisory: Dangerzone 0.11.1 released
We're pleased to announce that Dangerzone 0.11.1 has been released. This release mostly includes stability improvements and security fixes, with a few new features.
The highlights for this release are:
- Users can now choose to disable or skip update checks.
- GitHub release notes are no longer rendered from Markdown to HTML in the application.
- Documents are now accepted from stdin, and safe PDFs are written to stdout.
- (Linux-only) Users now get progress reports for image downloads.
- Documentation is now published at https://docs.dangerzone.rocks.
Security fixes
An internal security assessment fixed two vulnerabilities in the
dangerzone-image load-archive command, which is used to update the Dangerzone
sandbox on offline (air-gapped) computers. A malicious archive could create or
overwrite files on your computer, or be passed to Podman before Dangerzone
checked that it came from us
(GHSA-m282-wfqf-935m,
GHSA-pfm5-gp85-8g5p).
Converting documents is not affected, and most users are not affected either. If
you install sandbox updates with dangerzone-image load-archive, you are
strongly advised to update and to load only those archives that you have
prepared yourself. For more details, see our
security advisory.
Also, the Dangerzone project now has a formal security policy, so if you find other issues like this in our codebase, make sure to check it out.
Platform changes
- Add support for Fedora 45
- Add support for Ubuntu 26.10
- Make Dangerzone work on Tails 7.10.1+
Community contributions
For this release, we had help from community members. We want to thank:
- @marekl11, who added a mention to Winget as an alternative installation method, and fixed a typo (#1557, #1556).
- @vbrekher, who fixed a long-standing issue in our GUI regarding unreadable documents (#1558).
- All members who reported issues and opened discussions in our GitHub repo, thanks for helping us improve Dangerzone!
For a full list of the changes, see our changelog.
