CVE-2019-15640 (PHP, published 2019-08-26T17:15Z)
Description: value: Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/config/version.php
docs/release_notes.txt
Commit message: Release 3.17.10+190821


Vulnerable code:
$config['versionnumber'] = '3.17.9';
$config['assetsversionnumber'] = '30090';

Fixed code:
$config['versionnumber'] = '3.17.10';
$config['assetsversionnumber'] = '30091';
Changes from 3.17.9 (build 190731) to 3.17.10 (build 190821) August 21, 2019
-New translation: Uyghur kindly provided by Namsiz Adam (Carsten Schmitz)
-Fixed issue: cannot save questions anymore (lacrioque)
-Fixed issue: Tagalog translation not available (Carsten Schmitz)
-Fixed issue: Panel integration 500 error (lacrioque)
-Fixed issue [security]: XSS with contructor statements in textedit (lacrioque)
-Fixed issue [security]: Check both mime type and file extension when validating image (Olle Haerstedt) kindly reported by PAVOL MICHALEC/FREDERIK KOĽBÍK from ESET 
 ( https://www.eset.sk )
-Fixed issue [security]: #15137: XSS when use Predefined label sets (Denis Chenu) Reported by Michele Cisternino https://www.linkedin.com/in/michelecisternino/ (Denis Chenu)
-Fixed issue [security]: #15094 XSS in label title (Denis Chenu) Reported by Michele Cisternino https://www.linkedin.com/in/michelecisternino/ (Denis Chenu)
-Fixed issue [security]: #15094 XSS in Boxes (thanks to Michele Cisternino) (Denis Chenu)
-Fixed issue #14921: Ranking question on mobile devices (problem with dragging/scrolling) (Markus Flür)
-Fixed issue #14908: The Button "exit and clear survey entrys" should not be on the last page (endmessage) (Patrick Teichmann)
-Fixed issue #14443: "Go to survey" menu icon not working in collapsed menu mode (lacrioque)
#Updated translation: Uighur by c_schmitz
#Updated translation: Turkish by kayazeren
#Updated translation: Thai by adzpire, tomzt
#Updated translation: Swedish by eddylackmann
#Updated translation: Russian by vipgroup
#Updated translation: Romanian by cdorin, andreig
#Updated translation: Portuguese (Brazil) by alfonso-peixoto
#Updated translation: Polish by elissa
#Updated translation: Polish (Informal) by elissa
#Updated translation: Norwegian (Bokmål) by pmonstad
#Updated translation: Kurdish (Sorani) by AryaSarhan12
#Updated translation: Japanese by nomoto
#Updated translation: Italian by lfanfoni
#Updated translation: Italian (Informal) by lfanfoni
#Updated translation: Hungarian by kkd
#Updated translation: German by eddylackmann
#Updated translation: German (Informal) by eddylackmann
#Updated translation: French (France) by eddylackmann, b00z00, DenisChenu
#Updated translation: Dutch by Han
#Updated translation: Dutch (Informal) by Han
#Updated translation: Danish by Mikkel
#Updated translation: Croatian by rovinj
#Updated translation: Croatian by dominikvitt
#Updated translation: Catalan by qualitatuvic
#Updated translation: Arabic by RayhaneK, Muhammad_Hosny
#Updated translation: Amharic by cdorin