Debian Security Advisory 1032-1: It was discovered that the Plone content management system lacks security declarations for three internal classes. This allows manipulation of user portraits by unprivileged users.
e8078401c8eafd3f1a44a1a994a7f3669d2a42aa6427fda244abd182f30af580