2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

December

List overview
Download

MediaWiki-announce June 2012

mediawiki-announce@lists.wikimedia.org

1 participants
3 discussions

Start a nNew thread

MediaWiki security release 1.19.1

by Sam Reed

I would like to announce the release of MediaWiki 1.19.1. One security issue was discovered. Both Chris Steipp and Formafix discovered that the uselang http parameter was vulnerable to XSS. For more details, see https://bugzilla.wikimedia.org/show_bug.cgi?id=36938 Chris Steipp also improved the blacklisting of bad elements in SVG files. This includes catching known hostile files, and also disallowing the upload of svg files that include remote resources. This is work is part of an on-going effort to prevent exploits being hidden in uploaded SVG files. MediaWiki 1.19.1 also received a couple of other non-security bugfixes. Full release notes: https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/core.git;a=blob_plain;f=RE LEASE-NOTES-1.19;hb=1.19.1 https://www.mediawiki.org/wiki/Release_notes/1.19 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.tar.gz Patch to previous version (1.19.0): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html

11 years, 10 months

1
0
0 0

MediaWiki security release 1.18.4

by Sam Reed

I would like to announce the release of MediaWiki 1.18.4. One security issue was discovered. Both Chris Steipp and Formafix discovered that the uselang http parameter was vulnerable to XSS. For more details, see https://bugzilla.wikimedia.org/show_bug.cgi?id=36938 Chris Steipp also improved the blacklisting of bad elements in SVG files. This includes catching known hostile files, and also disallowing the upload of svg files that include remote resources. This is work is part of an on-going effort to prevent exploits being hidden in uploaded SVG files. Full release notes: https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/core.git;a=blob_plain;f=RE LEASE-NOTES-1.18;hb=1.18.4 https://www.mediawiki.org/wiki/Release_notes/1.18 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.4.tar.gz Patch to previous version (1.18.3): http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.4.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.4.tar.gz.sig http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.4.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html

11 years, 10 months

1
0
0 0

MediaWiki security release 1.17.5

by Sam Reed

I would like to announce the release of MediaWiki 1.17.5. One security issue was discovered. Both Chris Steipp and Formafix discovered that the uselang http parameter was vulnerable to XSS. For more details, see https://bugzilla.wikimedia.org/show_bug.cgi?id=36938 Chris Steipp also improved the blacklisting of bad elements in SVG files. This includes catching known hostile files, and also disallowing the upload of svg files that include remote resources. This is work is part of an on-going effort to prevent exploits being hidden in uploaded SVG files. Full release notes: https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/core.git;a=blob_plain;f=RE LEASE-NOTES;hb=1.17.5 https://www.mediawiki.org/wiki/Release_notes/1.17 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.17/mediawiki-1.17.5.tar.gz Patch to previous version (1.17.4): http://download.wikimedia.org/mediawiki/1.17/mediawiki-1.17.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.17/mediawiki-1.17.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.17/mediawiki-1.17.5.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html

11 years, 10 months

1
0
0 0