Notepad++ release 8.9.8

[donho]

Notepad++ release 8.9.8 is available:

https://notepad-plus-plus.org/news/v898-released/

Notepad++ v8.9.8 vulnerability fix, bug-fixes & new features:

1. Vulnerabilty: Fix an eventual crash while loading UDL. CVE ID not assigned yet
2. Vulnerabilty: Fix an eventual crash when loading a UTF-16 file. CVE ID not assigned yet
3. Vulnerabilty: Fix out-of-bounds array write. CVE ID not assigned yet
4. Vulnerabilty: Fix authenticode verification bypass. CVE ID not assigned yet
5. Vulnerabilty: Fix a TOCTOU issue in the Notepad++ Updater (WinGUp). CVE ID not assigned yet
6. Vulnerabilty: Fix session backup path-traversal allowing deletiion outside backup directory. CVE ID not assigned yet
7. Vulnerabilty: Fix potential exposure of Windows login info (SMB/NTLM) via UNC path. CVE ID not assigned yet 1, CVE ID not assigned yet 2, CVE ID not assigned yet 3, CVE ID not assigned yet 4
8. Vulnerabilty: Fix shortcuts.xml HMAC bypass via the “Run a Macro Multiple Times”. CVE ID not assigned yet
9. Vulnerabilty: Fix Null pointer in NPPM_SAVESESSION handler causing crash. CVE ID not assigned yet
10. Vulnerabilty: Fix stack buffer overflow caused by overlong session paths. CVE ID not assigned yet
11. Vulnerabilty: Fix Folder as Workspace “Run by system” target hijacking issue. CVE ID not assigned yet
12. Vulnerabilty: Fix install-path injection possibility with PowerShell. CVE ID not assigned yet
13. Vulnerabilty: Fix lower IL (Integrity Level) process sends WM_COMMAND to higher IL Notepad++. CVE ID not assigned yet
14. Vulnerabilty: Fix Notepad++ UIPI Bypass via WM_COPYDATA. CVE ID not assigned yet
15. Fix crash in WM_COPYDATA COPYDATA_PARAMS for invalid payload. (Fix #18207)
16. Fix crash in API NPPM_ALLOCATE* calls. (Fix #18222)
17. Add an option to allow loading symlinks in Folder as Workspace. (Fix #18226)
18. Regression: Fix loading session for alone subview and doc/tab with untitle name. (Fix #18294)
19. Fix CJK IME issues in Save As dialog. (Fix #11582, #15431, #16772, #12225, #12366)
20. Update to Scintilla 5.6.6 & Lexilla 5.5.3. (Implement #18290)
21. Add plugin deactivation capability. (Fix #18206)
22. Add “-monitoringMode” command line argument to open files with monitoring enabled. (Fix #18188)
23. Fix Proxy Settings issue in portable mode. (Fix #13382)
24. Fix langs.xml model update not not applying file extension fields. (Fix #18220)
25. Fix luminosity slider in ChooseColor not visible in dark mode. (Fix #12451)
26. Fix empty sub-menus in compact language menu. (Fix #18202)
27. Fix Search Results vertical scrolling not matching with OS mouse settings. (Implement #18194)
28. Use modern question mark icon in dark message box. (Fix Repported in comment)
29. Format count numbers using current locale separators when needed. (Fix #18190)

Auto-updater will be triggered in about 1 week, if no critical issue found in this release.

[xomx]

@donho

A serious regression: #18314
For that one, I have a simple fix ready and users already confirmed that it works ok.

There is also unconfirmed #18315, for which the user also stated that reverting to the previous v8.9.7 helps. But IDK what to think about that one, I cannot reproduce and from its description I don’t really get what could be going on there, can you take a look at it?