MediaWiki-announce January 2014

mediawiki-announce@lists.wikimedia.org

1 participants
4 discussions

MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11
by Chris Steipp 28 Jan '14

28 Jan '14

I would like to announce the release of MediaWiki 1.22.2, 1.21.5 and 1.19.11. Your MediaWiki installation is affected by a remote code execution vulnerability if you have enabled file upload support for DjVu (natively supported by MediaWiki) or PDF files (in combination with the PdfHandler extension). Neither file type is enabled by default in MediaWiki installations. If you are affected, we strongly urge you to update immediately. Affected supported versions: All == Security fixes == * Netanel Rubin from Check Point discovered a remote code execution vulnerability in MediaWiki's thumbnail generation for DjVu files. Internal review also discovered similar logic in the PdfHandler extension, which could be exploited in a similar way. (CVE-2014-1610) <https://bugzilla.wikimedia.org/show_bug.cgi?id=60339> == Bug Fixes in 1.22.2 == * (bug 58253) Check for very old PCRE versions in installer and updater * (bug 60054) Make WikiPage::$mPreparedEdit public Full release notes for 1.22.1: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.21.4: <https://www.mediawiki.org/wiki/Release_notes/1.21> Full release notes for 1.19.9: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.22.2 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.tar.gz Patch to previous version (1.22.1): http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.2.tar.gz.s… http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.patch.gz.sig http://download.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.2.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.21.5 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.tar.gz Patch to previous version (1.21.4): http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.5.tar.gz.s… http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.patch.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.5.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.19.11 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.tar.gz Patch to previous version (1.19.10): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.11.tar.gz.… http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.11.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Extension:PdfHandler ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:PdfHandler

1 0

Pre-Release Announcement for MediaWiki 1.22.2, 1.21.5, and 1.19.11
by Chris Steipp 27 Jan '14

27 Jan '14

This is a notice that on Tuesday, Jan 28th between 21:00-22:00 UTC (1-2pm PST) Wikimedia Foundation will release critical security updates for current and supported branches of the MediaWiki software and extensions. Downloads and patches will be available at that time, with the git repositories updated soon after. The vulnerable feature is not enabled in MediaWiki by default, however many sites will want to upgrade as soon as the patch is available.

1 0

MediaWiki Security Releases: 1.22.1, 1.21.4 and 1.19.10
by Chris Steipp 13 Jan '14

13 Jan '14

I would like to announce the release of MediaWiki 1.22.1, 1.21.4 and 1.19.10. These releases fix a number of security related bugs that could affect users of MediaWiki. In addition, MediaWiki 1.22.1 is a maintenance release. It fixes several bugs. You can consult the RELEASE-NOTES-1.22 file for the full list of changes in this version. Download links are given at the end of this email. == Security fixes == * MediaWiki user Michael M reported that the fix for bug 55332 (CVE-2013-4568) allowed insertion of escaped CSS values which could pass the CSS validation checks, resulting in XSS. (CVE-2013-6451) <https://bugzilla.wikimedia.org/show_bug.cgi?id=58088> * Chris from RationalWiki reported that SVG files could be uploaded that include external stylesheets, which could lead to XSS when an XSL was used to include JavaScript. (CVE-2013-6452) <https://bugzilla.wikimedia.org/show_bug.cgi?id=57550> * During internal review, it was discovered that MediaWiki's SVG sanitization could be bypassed when the XML was considered invalid. (CVE-2013-6453) <https://bugzilla.wikimedia.org/show_bug.cgi?id=58553> * Durign internal review, it was discovered that MediaWiki's CSS sanitization did not filter -o-link attributes, which could be used to execute JavaScript in Opera 12. (CVE-2013-6454) <https://bugzilla.wikimedia.org/show_bug.cgi?id=58472> * During internal review, it was discovered that MediaWiki displayed some information about deleted pages in the log API, enhanced RecentChanges, and user watchlists. (CVE-2013-6472) <https://bugzilla.wikimedia.org/show_bug.cgi?id=58699> Additionally, the following extensions have been updated to fix security issues: * TimedMediaHandler: Bawolff discovered an XSS vulnerability with the way the extension stored and used HTML for showing videos. (CVE-2013-4574) <https://bugzilla.wikimedia.org/show_bug.cgi?id=56699> * Scribuntu: Internal review found a NULL pointer dereference in php-luasandbox, which could be used for DoS attacks. (CVE-2013-4570) <https://bugzilla.wikimedia.org/show_bug.cgi?id=54527> * Scribuntu: Internal review found a Buffer Overflow in php-luasandbox. It's not know if this could be use for code execution on the server. (CVE-2013-4571) <https://bugzilla.wikimedia.org/show_bug.cgi?id=49705> * CentralAuth: Eran Roz reported that MediaWiki usernames could be leaked to other websites. Javascript returned for CentralAuth's login would update the page DOM with the username, even when included on other sites. (CVE-2013-6455) <https://bugzilla.wikimedia.org/show_bug.cgi?id=57081> * SemanticForms: Ravindra Singh Rathore reported a missing CSRF check to Mozilla, who reported the issue to us. Several other forms in the extension were also fixed. <https://bugzilla.wikimedia.org/show_bug.cgi?id=57025> == Bug fixes in 1.22.1 == * (bug 59945) 1.22 tarball offers Extension SimpleAntiSpam which is supposed to be in core. * (bug 58178) Restore compatibility with curl < 7.16.2. * (bug 56931) Updated the plural rules to CLDR 24. They are in new format which is detailed in UTS 35 Rev 33. The PHP parser and evaluator as well as the JavaScript evaluator were updated to support the new format. Plural rules for some languages have changed, most notably Russian. Affected software messages have been updated and marked for review at translatewiki.net. This change is backported from the development branch of MediaWiki 1.23. * (bug 58434) The broken installer for database backend Oracle was fixed. * (bug 58167) The web installer no longer throws an exception when PHP is compiled without support for MySQL yet with support for another DBMS. * (bug 58640) Fixed a compatibility issue with PCRE 8.34 that caused pages to appear blank or with missing text. * (bug 47055) Changed FOR UPDATE handling in Postgresql Full release notes for 1.22.1: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.21.4: <https://www.mediawiki.org/wiki/Release_notes/1.21> Full release notes for 1.19.9: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.22.1 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.1.tar.gz Patch to previous version (1.22.0), without interface text: http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.1.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.1.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.1.tar.gz.s… http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.1.tar.gz.sig http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.1.patch.gz.sig http://download.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.1.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.21.4 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.4.tar.gz Patch to previous version (1.21.3), without interface text: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.4.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.4.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.4.tar.gz.s… http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.4.tar.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.4.patch.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.4.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.19.10 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.10.tar.gz Patch to previous version (1.19.9), without interface text: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.10.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.10.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.10.tar.gz.… http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.10.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.10.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.10.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Extension:TimedMediaHandler ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:TimedMediaHandler ********************************************************************** Extension:Scribunto ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Scribunto ********************************************************************** Extension:CentralAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CentralAuth ********************************************************************** Extension:SemanticForms ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:SemanticForms

1 0

Pre-Release Announcement for MediaWiki 1.19.10, 1.21.4, and 1.22.1
by Chris Steipp 10 Jan '14

10 Jan '14

This is a notice that on Tuesday, January 14th between 00:00-01:00 UTC (*Monday* January 13th, 4-5pm PST) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software, as well as several extensions. Downloads and patches will be available at that time.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce January 2014