MediaWiki-announce December 2008

mediawiki-announce@lists.wikimedia.org

2 participants
2 discussions

Packaging errors in latest MediaWiki releases; release of MediaWiki 1.12.3

by Tim Starling

Due to a packaging error, I've decided to increment the version number of the 1.12 branch for the purposes of repackaging. The 1.12.2 tarball was missing 135 out of 1256 distributed files. Also, note that the patch files that were released initially were missing includes/IEContentAnalyzer.php. If you try to run MediaWiki 1.13.3 or 1.12.3 without this file, uploads will not work. I have fixed this without incrementing the version number. The MediaWiki 1.13.3 .tar.gz file was correct -- if you are using that, you can ignore this notice. Fixed 1.13.3 patch: http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz You can also download the file that was missing file here: <http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/IEContentAn…> ********************************************************************** New 1.12.3 download: http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.3.tar.gz Patch to previous version (1.12.1), without interface text: http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.3.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.3.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.3.tar.gz.sig http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.3.patch.gz.sig http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.3.patch.gz… Public keys: https://secure.wikimedia.org/keys.html

15 years, 4 months

MediaWiki 1.13.3, 1.12.2, 1.6.11 security update

by Tim Starling

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is a security release of MediaWiki 1.13.3, 1.12.1 and 1.6.11. Some of the security issues affect *all* versions of MediaWiki except the versions released today, so all site administrators are encouraged to upgrade. Users of the development (trunk) branch should upgrade to r44506 or later. David Remahl of Apple's Product Security team has identified a number of security issues in MediaWiki. Subsequent analysis by the MediaWiki development team led to further discoveries. The issues with a significant impact are as follows: * An XSS vulnerability affecting all MediaWiki installations between 1.13.0 and 1.13.2. [CVE-2008-5249] * A local script injection vulnerability affecting Internet Explorer clients for all MediaWiki installations with uploads enabled. [CVE-2008-5250] * A local script injection vulnerability affecting clients with SVG scripting capability (such as Firefox 1.5+), for all MediaWiki installations with SVG uploads enabled. [CVE-2008-5250] * A CSRF vulnerability affecting the Special:Import feature, for all MediaWiki installations since the feature was introduced in 1.3.0. [CVE-2008-5252] These four vulnerabilities are all fixed in these releases. XSS (cross-site scripting) vulnerabilities allow an attacker to steal an authorised user's login session, and to act as that user on the wiki. The authorised user must visit a web page controlled by the attacker in order to activate the attack. Intranet wikis are vulnerable if the attacker can determine the intranet URL. Local script injection vulnerabilities are like XSS vulnerabilities, except that the attacker must have an account on the local wiki, and there is no external site involved. The attacker uploads a script to the wiki, which another user is tricked into executing, with the effect that the attacker is able to act as the privileged user. CSRF vulnerabilities allow an attacker to act as an authorised user on the wiki, but unlike an XSS vulnerability, the attacker can only act as the user in a specific and restricted way. The present CSRF vulnerability allows pages to be edited, with forged revision histories. Like an XSS vulnerability, the authorised user must visit the malicious web page to activate the attack. David Remahl also reminded us of some security-related configuration issues: * Since 1.11, by default, MediaWiki stores a backup of deleted images in the images/deleted directory. If you do not want these images to be publically accessible, make sure this directory is not accessible from the web. MediaWiki takes some steps to avoid leaking these images, but these measures are not perfect. * Set display_errors=off in your php.ini to avoid path disclosure via PHP fatal errors. This is the default on most shared web hosts. * Enabling MediaWiki's debugging features, such as $wgShowExceptionDetails, may lead to path disclosure. Users of MediaWiki 1.6.x (the last branch which supported PHP 4) are strongly recommended to upgrade to PHP 5 and MediaWiki 1.13.3. It is not necessary to upgrade to 1.6.11 first, just upgrade directly to the latest version. Upgrade FAQ: http://www.mediawiki.org/wiki/Manual:FAQ#Upgrading Full release notes: http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_3/phase3/RELEASE-NO… http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_2/phase3/RELEASE-NO… http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_11/phase3/RELEASE-NO… ********************************************************************** MEDIAWIKI 1.13.3 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.tar.gz Patch to previous version (1.13.2), without interface text: http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.3.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.tar.gz.sig http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz.sig http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.3.patch.gz… Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** MEDIAWIKI 1.12.2 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.tar.gz Patch to previous version (1.12.1), without interface text: http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.2.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.patch.gz.sig http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.2.patch.gz… Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** MEDIAWIKI 1.6.11 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.tar.gz Patch to previous version (1.6.10): http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.tar.gz.sig http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJRjrodWgrCOij/sQRArfRAKCB2hGPDi0ykHUXndIA0kAgUdW9yACeLZm/ tRkFhqQOG7EWVcpvWDMVjLY= =zgL1 -----END PGP SIGNATURE-----

15 years, 4 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce December 2008