BleachBit 6.0.4 Fixes Critical File Wiping Flaw on Windows
BleachBit 6.0.4 resolves a significant bug in its secure file deletion feature on Windows, ensuring that fragmented files are now completely overwritten.
The open-source system cleaner BleachBit has released version 6.0.4, bringing important security and functionality updates across Windows, Linux, and macOS platforms.
A critical flaw identified in earlier Windows versions of BleachBit meant that its secure file wiping functionality was not always effective. When a file became fragmented on a Windows system – a common occurrence when the operating system cannot allocate a contiguous block of disk space – BleachBit would fail to overwrite all clusters containing parts of the file. This oversight could leave sensitive data recoverable on the disk, undermining the tool's primary purpose of secure deletion.
The release notes do not specify which versions were affected or the extent of data remnants left behind, making it impossible to determine precisely which files were at risk. For users concerned about past deletions, the developers recommend wiping free space on affected drives to mitigate potential data recovery.
Beyond the core file wiping fix, BleachBit 6.0.4 also addresses several other security enhancements. It now properly deletes dynamic HSTS data from Chromium-based browsers and Zen, a Firefox derivative, which can otherwise be used for tracking users across sites. Additionally, the tool has improved its handling of file paths, refusing to shred sensitive system directories like /, /proc, /sys, and /run on POSIX systems, and closing a path that could have collapsed to the current directory.
Further hardening measures include preventing the tool from following symbolic links or reparse points during wiping operations on Windows. Shredding files from the clipboard now skips malformed URIs, and BleachBit issues a warning if the drive being wiped is world-writable, as such operations are inherently less secure. The Windows build now calls system commands like ipconfig and taskkill using absolute paths to prevent potential hijacking through manipulated executable search paths.
Other security improvements include hardening against DLL preloading attacks, restricting untrusted cleaner definitions from executing sensitive actions, and preventing the loading of cleaner files from world-writable locations on POSIX systems. XML parsing entry points now reject DTDs across the board, and the update check mechanism has been fortified against potential injection and denial-of-service attacks.
BleachBit 6.0.4 also introduces new cleaners for applications such as Android Studio, the Gradle cache, and the fish and Zsh shells, along with Python command history. Early support for macOS has been expanded with a Safari cleaner and improved functionality for existing cleaners like Google Chrome and Firefox on the platform.
The update signifies a commitment to robust data sanitization and overall system security, ensuring that users can rely on BleachBit for effective data deletion and system cleanup across multiple operating systems.