The security issue in views is caused by various places in the views UI where a string is not sanitized,
because it has been assumed to be static and by commiters, though you can change some of these strings using other administrative permissions. SA-CONTRIB-2013-035 - Views - Cross Site Scripting (XSS)
Other commits:
#82088 by grisendo: Add sanitation in various places in the views UI
#1920690 by jnettik: Added Allow for inline to be configured for jump menus.
#1551534 by bcn: Added Allow a button in an exposed forms to trigger ajax.
#1914024 by peximo | heyyo: Fixed Title-overriden term name not translated on a taxonomy overriden views page.
#1889198 by Pedro Lozano: Fixed Performance problem in _views_fetch_data(), multiple unnecessary cache rebuilds.
#1496418 by dawehner, hass, webflo: Fixed Views: Don't change capitalization of translatable strings with CSS.
#1852116 by Les Lim, Chris Burge: Added Backport from D8: Customizable true/false Views output for booleans.
This release contains some minor but important bug fixes that was introduced in the last release.
* Fixed selection of images in blog extension
* Fixed undefined object function in image URL
* Fixed selection of background images in user extension
* Issue #1914582 by cableman0408: User cannot change background image in the profile