MediaWiki-announce April 2013

mediawiki-announce@lists.wikimedia.org

1 participants
4 discussions

MediaWiki Security Release: 1.20.5 and 1.19.6
by Chris Steipp 01 May '13

01 May '13

I would like to announce the release of MediaWiki 1.20.5 and 1.19.6. These releases fix 2 security related issues that could affect users of MediaWiki. Download links are given at the end of this email. * Jan Schejbal / Hatforce.com reported that SVG script filtering could be bypassed for Chrome and Firefox clients by using an encoding that MediaWiki understood, but these browsers interpreted as UTF-8. <https://bugzilla.wikimedia.org/show_bug.cgi?id=47304> * Internal review discovered that extensions were not given the opportunity to disable a password reset, which could lead to circumvention of two-factor authentication. <https://bugzilla.wikimedia.org/show_bug.cgi?id=46590> Full release notes for 1.20.5: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.6: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.5 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.tar.gz Patch to previous version (1.20.4), without interface text: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.patch.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.5.patch.gz… Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.6 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.tar.gz Patch to previous version (1.19.5), without interface text: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.6.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.6.patch.gz… Public keys: https://secure.wikimedia.org/keys.html

1 0

Pre-Release Announcement for MediaWiki 1.19.6 and 1.20.5
by Chris Steipp 30 Apr '13

30 Apr '13

This is a notice that on Tuesday, April 30th between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon.

1 0

MediaWiki Security Release: 1.20.4 and 1.19.5
by Chris Steipp 16 Apr '13

16 Apr '13

I would like to announce the release of MediaWiki 1.20.4 and 1.19.5. These releases fix 3 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email. * An internal review discovered that specially crafted Lua function names could lead to XSS. <https://bugzilla.wikimedia.org/show_bug.cgi?id=46084> * Daniel Franke reported that during SVG parsing, MediaWiki failed to prevent XML external entity (XXE) processing. This could lead to local file disclosure, or potentially remote command execution in environments that have enabled expect:// handling. <https://bugzilla.wikimedia.org/show_bug.cgi?id=46859> * Internal review also discovered that Special:Import, and Extension:RSS failed to prevent XML external entity (XXE) processing. <https://bugzilla.wikimedia.org/show_bug.cgi?id=47251> Full release notes for 1.20.4: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.5: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.4 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.tar.gz Patch to previous version (1.20.3): http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.5 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.tar.gz Patch to previous version (1.19.4): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** Extension:RSS ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:RSS

1 0

Pre-Release Announcement for MediaWiki 1.19.5 and 1.20.4
by Chris Steipp 13 Apr '13

13 Apr '13

This is a notice that on Monday, April 15th between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon. CVSS scores are between 4.3 and 7.1, most users will want to update.

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce April 2013