bugtraq - [ MDVSA-2015:200 ] mediawiki

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 10 Apr 2015 07:43:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2015:200 ] mediawiki

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:200
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : mediawiki
 Date    : April 10, 2015
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated mediawiki packages fix security vulnerabilities:
 
 In MediaWiki before 1.23.9, one could circumvent the SVG MIME blacklist
 for embedded resources. This allowed an attacker to embed JavaScript
 in the SVG (CVE-2015-2931).
 
 In MediaWiki before 1.23.9, the SVG filter to prevent injecting
 JavaScript using animate elements was incorrect (CVE-2015-2932).
 
 In MediaWiki before 1.23.9, a stored XSS vulnerability exists due
 to the way attributes were expanded in MediaWiki&#039;s Html class, in
 combination with LanguageConverter substitutions (CVE-2015-2933).
 
 In MediaWiki before 1.23.9, MediaWiki&#039;s SVG filtering could be bypassed
 with entity encoding under the Zend interpreter. This could be used
 to inject JavaScript (CVE-2015-2934).
 
 In MediaWiki before 1.23.9, one could bypass the style filtering for
 SVG files to load external resources. This could violate the anonymity
 of users viewing the SVG (CVE-2015-2935).
 
 In MediaWiki before 1.23.9, MediaWiki versions using PBKDF2 for
 password hashing (not the default for 1.23) are vulnerable to DoS
 attacks using extremely long passwords (CVE-2015-2936).
 
 In MediaWiki before 1.23.9, MediaWiki is vulnerable to Quadratic
 Blowup DoS attacks, under both HHVM and Zend PHP (CVE-2015-2937).
 
 In MediaWiki before 1.23.9, the MediaWiki feature allowing a user to
 preview another user&#039;s custom JavaScript could be abused for privilege
 escalation (CVE-2015-2938).
 
 In MediaWiki before 1.23.9, function names were not sanitized in Lua
 error backtraces, which could lead to XSS (CVE-2015-2939).
 
 In MediaWiki before 1.23.9, the CheckUser extension did not prevent
 CSRF attacks on the form allowing checkusers to look up sensitive
 information about other users. Since the use of CheckUser is logged,
 the CSRF could be abused to defame a trusted user or flood the logs
 with noise (CVE-2015-2940).
 
 The mediawiki package has been updated to version 1.23.9, fixing
 these issues and other bugs.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2931
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2932
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2933
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2934
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2935
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2936
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2937
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2938
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2939
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2940
 http://advisories.mageia.org/MGASA-2015-0142.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 0a5719c634720b2f09037024a6d92d87  mbs1/x86_64/mediawiki-1.23.9-1.mbs1.noarch.rpm
 c1e4e0b2eaea6bc47bf1d97af2d8de9d  mbs1/x86_64/mediawiki-mysql-1.23.9-1.mbs1.noarch.rpm
 305c803833c271e39ae22f8ab5b04db1  mbs1/x86_64/mediawiki-pgsql-1.23.9-1.mbs1.noarch.rpm
 a809cbf86973b4735d0fb874ebbe392b  mbs1/x86_64/mediawiki-sqlite-1.23.9-1.mbs1.noarch.rpm 
 0b17278c7df09036f5767b88fbc82be7  mbs1/SRPMS/mediawiki-1.23.9-1.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVJ1TJmqjQ0CJFipgRApYDAJ9rJau34w29lPzFkaWl2FGTkk25ZgCgvZRx
6mm0PNl6l4BvWIB3H2gyscM=
=Ma5j
-----END PGP SIGNATURE-----