MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

331 discussions

Security Release: 1.25.3, 1.24.4 and 1.23.11
by Chad 16 Oct '15

16 Oct '15

I would like to announce the release of MediaWiki 1.25.3, 1.24.4, and 1.23.11. These releases fix five security issues in core, in addition to other bug fixes. Download links are given at the end of this email == Security fixes == * Wikipedia user RobinHood70 reported two issues in the chunked upload API. The API failed to correctly stop adding new chunks to the upload when the reported size was exceeded (T91203), allowing a malicious users to upload add an infinite number of chunks for a single file upload. Additionally, a malicious user could upload chunks of 1 byte for very large files, potentially creating a very large number of files on the server's filesystem (T91205). <https://phabricator.wikimedia.org/T91203> <https://phabricator.wikimedia.org/T91205> * Internal review discovered that it is not possible to throttle file uploads. <https://phabricator.wikimedia.org/T91850> * Internal review discovered a missing authorization check when removing suppression from a revision. This allowed users with the 'viewsuppressed' user right but not the appropriate 'suppressrevision' user right to unsuppress revisions. <https://phabricator.wikimedia.org/T95589> * Richard Stanway from teamliquid.net reported that thumbnails of PNG files generated with ImageMagick contained the local file path in the image metadata. <https://phabricator.wikimedia.org/T108616> == Bug Fixes in 1.25.3 == * Fix having multiple callbacks for a single hook. <https://phabricator.wikimedia.org/T98975> * maintenance/refreshLinks.php did not always remove all links pointing to nonexistent pages. <https://phabricator.wikimedia.org/T107632> * $wgEmergencyContact and $wgPasswordSender now use their default value if set to an empty string. <https://phabricator.wikimedia.org/T104142> * Provide fallbacks for use of mb_convert_encoding() in HtmlFormatter. It was causing an error when accessing the api help page if the mbstring PHP extension was not installed. <https://phabricator.wikimedia.org/T62174> * Confirmation emails would sometimes contain invalid codes. <https://phabricator.wikimedia.org/T105896> * Fixed edit stash inclusion queries. <https://phabricator.wikimedia.org/T105597> == Bug Fixes in 1.24.4 == * Minimal PSR-3 debug logger to support backports from 1.25+. <https://phabricator.wikimedia.org/T91653> * Fix indexing of moved pages with PostgreSQL. Requires running update.php to fix. <https://phabricator.wikimedia.org/T68650> == Release notes == Full release notes for 1.25.3: <https://www.mediawiki.org/wiki/Release_notes/1.25> Full release notes for 1.24.4: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.11: <https://www.mediawiki.org/wiki/Release_notes/1.23> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.25.3 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.tar.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.3.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.patch.gz https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.3.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.3.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.24.4 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.tar.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.4.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.patch.gz https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.4.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.4.tar.gz.… https://releases.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.4.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.23.11 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.tar.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.11.tar.gz Patch to previous version: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.patch.gz https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.11.patch.… GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.11.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.11.tar.gz… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.11.patch.… Public keys: https://www.mediawiki.org/keys/keys.html -Chad

1 0

Announcement: Security Release Tomorrow
by Chad 15 Oct '15

15 Oct '15

Hi all, Tomorrow we will be issuing a security release to all supported branches of MediaWiki. The new releases will be: 1.25.3 1.24.4 1.23.11 Fixes will be available in these respective release branches, the unreleased 1.26.x branch, and master. Tarballs will be available for the above mentioned point releases as well. This security release will encompass core only, no bundled extensions are affected. -Chad

1 0

MediaWiki Security and Maintenance Releases: 1.25.2, 1.24.3, 1.23.10
by Chad 10 Aug '15

10 Aug '15

I would like to announce the release of MediaWiki 1.25.2, 1.24.3, and 1.23.10. These releases fix three security issues in core, in addition to other bug fixes. Several extensions have also had security issues fixed. Download links are given at the end of this email == Security fixes == * Internal review discovered that Special:DeletedContributions did not properly protect the IP of autoblocked users. This fix makes the functionality of Special:DeletedContributions consistent with Special:Contributions and Special:BlockList. <https://phabricator.wikimedia.org/T106893> * Internal review discovered that watchlist anti-csrf tokens were not being compared in constant time, which could allow various timing attacks. This could allow an attacker to modify a user's watchlist via csrf. <https://phabricator.wikimedia.org/T94116> * John Menerick reported that MediaWiki's thumb.php failed to sanitize various error messages, resulting in xss. <https://phabricator.wikimedia.org/T97391> Additionally, the following extensions have been updated to fix security issues: * Extension:SemanticForms - MediaWiki user Grunny discovered multiple reflected xss vectors in SemanticForms. Further internal review discovered and fixed other reflected and stored xss vectors. <https://phabricator.wikimedia.org/T103391> <https://phabricator.wikimedia.org/T103765> <https://phabricator.wikimedia.org/T103761> * Extension:SyntaxHighlight_GeSHi - xss and potential DoS vectors. Internal review discovered that the contib directory for GeSHi was re-included in MediaWiki 1.25. Some scripts could be potentially be used for DoS, and DAU Huy Ngoc discovered an xss vector. All contrib scripts have been removed. <https://phabricator.wikimedia.org/T108198> * Extension:TimedMediaHandler - User:McZusatz reported that resetting transcodes deleted the transcode without creating a new one, which could be used for vandalism or potentially DoS. <https://phabricator.wikimedia.org/T100211> * Extension:Quiz - Internal review discovered that Quiz did not properly escape regex metacharacters in a user controlled regular expression, enabling a DoS vector. <https://phabricator.wikimedia.org/T97083> * Extension:Widgets - MediaWiki developer Majr reported a potential HTML injection (xss) vector. <https://phabricator.wikimedia.org/T88964> == Bug Fixes in 1.25.2 == * (T102562) Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia Commons. * (T100767) Setting a configuration setting for skin or extension to false in LocalSettings.php was not working. * (T100635) API action=opensearch json output no longer breaks when $wgDebugToolbar is enabled. * (T102522) Using an extension.json or skin.json file which has a "manifest_version" property for 1.26 compatability will no longer trigger warnings. * (T86156) Running updateSearchIndex.php will not throw an error as page_restrictions has been added to the locked table list. * Special:Version would throw notices if using SVN due to an incorrectly named variable. Add an additional check that an index is defined. == Bug Fixes in 1.24.3 == * Update jQuery from v1.11.2 to v1.11.3. * (T102562) Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia Commons. == Bug Fixes in 1.23.10 == * (bug 67644) Make AutoLoaderTest handle namespaces * (T91653) Minimal PSR-3 debug logger to support backports from 1.25+. * (T102562) Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia Commons. Full release notes for 1.25.2: <https://www.mediawiki.org/wiki/Release_notes/1.25> Full release notes for 1.24.3: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.10: <https://www.mediawiki.org/wiki/Release_notes/1.23> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Mediawiki downloads and patches ********************************************************************** Full release notes: https://www.mediawiki.org/wiki/Release_notes/1.25 https://www.mediawiki.org/wiki/Release_notes/1.24 https://www.mediawiki.org/wiki/Release_notes/1.23 Download: http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.2.tar.gz http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.3.tar.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.10.tar.gz Download (no bundled extensions): http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.2.patch.gz http://download.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.3.patch.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.10.patch.gz Patch to previous version: http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.2.patch.gz http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.3.patch.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.10.patch.gz Localization patch to previous version: http://download.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.2.patch.gz http://download.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.3.patch.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.10.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.3.tar.gz.sig http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.10.tar.gz.sig http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.2.patch.gz… http://download.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.3.patch.gz… http://download.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.10.patch.g… http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.2.patch.gz.sig http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.3.patch.gz.sig http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.10.patch.gz.sig http://download.wikimedia.org/mediawiki/1.25/mediawiki-i18n-1.25.2.patch.gz… http://download.wikimedia.org/mediawiki/1.24/mediawiki-i18n-1.24.3.patch.gz… http://download.wikimedia.org/mediawiki/1.23/mediawiki-i18n-1.23.10.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Extension:Semantic Forms ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Semantic_Forms ********************************************************************** Extension:SyntaxHighlight_GeSHi ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:SyntaxHighlight_GeSHi ********************************************************************** Extension:TimedMediaHandler ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:TimedMediaHandler ********************************************************************** Extension:Quiz ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Quiz ********************************************************************** Extension:Widgets ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Widgets -Chad

1 0

MediaWiki bug fix release 1.25.1
by Chris Steipp 26 May '15

26 May '15

Hello everyone, The ConfirmEdit extension in the 1.25.0 tarball contained a syntax error in two JSON files. We deeply apologize for this error, and thanks to Paul Villiger for reporting the issue. A new 1.25.1 tarball has been released which fixes the issue. Users using git can update to the latest REL1_25 branch. Full release notes: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_25/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.25 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.1.tar.gz http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.1.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.1.tar.gz.s… http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.1.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html

1 0

End of life announcement - 1.19.x LTS
by Chad 25 May '15

25 May '15

Hi, With the release of MediaWiki 1.25, the lifetime of MediaWiki version 1.19.x LTS ends. Users still using MediaWiki 1.19.x are advised to upgrade to version 1.25.0 (latest stable) or 1.23.x (legacy and LTS version). -Chad Horohoe, MW Release Manager

1 0

MediaWiki 1.25 Now Available
by Chad 25 May '15

25 May '15

Hello everyone, I am happy to announce the availability of the first stable release of the new MediaWiki 1.25 series. MediaWiki 1.25 is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users. You can consult the RELEASE-NOTES-1.25 file for the full list of changes in this version. Our thanks to everyone who helped to improve MediaWiki by testing the release candidates and submitting bug reports. == What's new for users? == MediaWiki 1.25 includes all changes released in the smaller 1.25wmf* software deployments to Wikimedia sites over six months, totaling approximately 2200 changes. * Indicators – Templates that add icons to the top right corner of the page (and more) can be updated to use the new page status indicators feature. * Enhanced recent changes – MediaWiki now uses by default the extended watchlist and so called enhanced recent changes (preference "Group changes by page in recent changes and watchlist"), which also received several improvements in MediaWiki 1.24 and 1.25 (task 37785). This means that Special:RecentChanges and Special:Watchlist show all the changes to each page in a given day, sorted by page rather than chronologically. Changes to each page are collapsed by default and a compact overview is shown, with links to collated diffs and counts of each user's actions. Full activity for an individual page can then be shown with a single click. Users will no longer need to know in detail how a single change was chosen for display in order to figure out what else may have happened to the page that day, nor to scan a long list of non-contiguous lines on the screen in order to get a complete picture. The change is part of MediaWiki's evolution towards an interface which is more discoverable and less cluttered by default, while equally easy to quickly access in full, with the help of JavaScript. However, the (grouped) layout is an improvement for non-JavaScript users as well. * Live preview – While editing, you're not sure what a wikitext syntax will produce? That's no longer a problem, now that live preview is no longer experimental. By enabling the feature in your preferences, MediaWiki will display the effect of your edits without fully reloading the page, so that you can quickly correct any mistake. * Import – The import tool is now much easier to use on content from a wiki which has different namespaces than yours (e.g. because it's in another language). * Internationalization – In logging and gender support, continuing the work in MediaWiki 1.18 and 1.19, multiple log types of Special:Log have been migrated to the new logging system, which allows full internationalization including word order and grammatical gender. The migration continues. See task T26620 for a list. Locales – The following locales have been added: अवधी, بلوچی رخشانی and Koyraboro Senni. * API documentation is localized and easier to access through Special:ApiHelp. == What's new for system administrators? == * PHP 5.3.3 is now required (from 5.3.2) * Extensions and skins are now loaded through a new registration system * Profiling was completely overhauled to use the xhprof module. Full release notes: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_25/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.25 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.0.tar.gz http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.25/mediawiki-core-1.25.0.tar.gz.s… http://download.wikimedia.org/mediawiki/1.25/mediawiki-1.25.0.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html -Chad Horohoe, MW Release Manager

1 0

MediaWiki Security and Maintenance Releases: 1.19.24, 1.23.9, and 1.24.2
by Chris Steipp 31 Mar '15

31 Mar '15

I would like to announce the release of MediaWiki 1.24.2, 1.23.9 and 1.19.24. These releases fix 10 security issues, in addition to other bug fixes. Download links are given at the end of this email. == Security fixes == * iSEC Partners discovered a way to circumvent the SVG MIME blacklist for embedded resources (iSEC-WMF1214-11). This allowed an attacker to embed JavaScript in the SVG. The issue was additionally identified by Mario Heiderich / Cure53. MIME types are now whitelisted. <https://phabricator.wikimedia.org/T85850> * MediaWiki user Bawolff pointed out that the SVG filter to prevent injecting JavaScript using animate elements was incorrect. <https://phabricator.wikimedia.org/T86711> * MediaWiki user Bawolff reported a stored XSS vulnerability due to the way attributes were expanded in MediaWiki's Html class, in combination with LanguageConverter substitutions. <https://phabricator.wikimedia.org/T73394> * Internal review discovered that MediaWiki's SVG filtering could be bypassed with entity encoding under the Zend interpreter. This could be used to inject JavaScript. This issue was also discovered by Mario Gomes from Beyond Security. <https://phabricator.wikimedia.org/T88310> * iSEC Partners discovered a XSS vulnerability in the way api errors were reflected when running under HHVM versions before 3.6.1 (iSEC-WMF1214-8). MediaWiki now detects and mitigates this issue on older versions of HHVM. <https://phabricator.wikimedia.org/T85851> * Internal review and iSEC Partners discovered (iSEC-WMF1214-1) that MediaWiki versions using PBKDF2 for password hashing (the default since 1.24) are vulnerable to DoS attacks using extremely long passwords. <https://phabricator.wikimedia.org/T64685> * iSEC Partners discovered that MediaWiki's SVG and XMP parsing, running under HHVM, was susceptible to "Billion Laughs" DoS attacks (iSEC-WMF1214-13). <https://phabricator.wikimedia.org/T85848> * Internal review found that MediaWiki is vulnerable to "Quadratic Blowup" DoS attacks, under both HHVM and Zend PHP. <https://phabricator.wikimedia.org/T71210> * iSEC Partners discovered a way to bypass the style filtering for SVG files (iSEC-WMF1214-3). This could violate the anonymity of users viewing the SVG. <https://phabricator.wikimedia.org/T85349> * iSEC Partners reported that the MediaWiki feature allowing a user to preview another user's custom JavaScript could be abused for privilege escalation (iSEC-WMF1214-10). This feature has been removed. <https://phabricator.wikimedia.org/T85855> Additionally, the following extensions have been updated to fix security issues: * Extension:Scribunto - MediaWiki user Jackmcbarn discovered that function names were not sanitized in Lua error backtraces, which could lead to XSS. <https://phabricator.wikimedia.org/T85113> * Extension:CheckUser - iSEC Partners discovered that the CheckUser extension did not prevent CSRF attacks on the form allowing checkusers to look up sensitive information about other users (iSEC-WMF1214-6). Since the use of CheckUser is logged, the CSRF could be abused to defame a trusted user or flood the logs with noise. <https://phabricator.wikimedia.org/T85858> == Bug fixes == === 1.24 === * Fix case of SpecialAllPages/SpecialAllMessages in SpecialPageFactory to fix loading these special pages when $wgAutoloadAttemptLowercase is false. * (bug T76254) Fix deleting of pages with PostgreSQL. Requires a schema change and running update.php to fix. == 1.23 & 1.24 == * (bug T70087) Fix Special:ActiveUsers page for installations using PostgreSQL. ********************************************************************** Full release notes: https://www.mediawiki.org/wiki/Release_notes/1.24 https://www.mediawiki.org/wiki/Release_notes/1.23 https://www.mediawiki.org/wiki/Release_notes/1.19 Download: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.tar.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.tar.gz http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.tar.gz Patch to previous version: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.patch.gz http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.patch.gz http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.24/mediawiki-1.24.2.patch.gz.sig http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.tar.gz.sig http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.9.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.24.patch.gz.sig Extensions: http://www.mediawiki.org/wiki/Extension:Scribunto http://www.mediawiki.org/wiki/Extension:CheckUser Public keys: https://www.mediawiki.org/keys/keys.html

1 0

Pre-Release Announcement for MediaWiki 1.19.24, 1.23.9, 1.24.2
by Chris Steipp 30 Mar '15

30 Mar '15

This is a notice that on Tuesday, March 31st between 21:00-22:00 UTC (2-3pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time.

1 0

MediaWiki Security and Maintenance Releases: 1.24.1, 1.23.8, 1.22.15 and 1.19.23
by Markus Glaser 17 Dec '14

17 Dec '14

Hello everyone, I would like to announce the release of MediaWiki 1.24.1, 1.23.8, 1.22.15 and 1.19.23. This is a regular security and maintenance release. Download links are given at the end of this email. Please note this release marks the end of lifetime for MediaWiki 1.22 branch. == Security fixes in 1.24.1, 1.23.8, 1.22.15 and 1.19.23 == * (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which could lead to xss. Permission to edit MediaWiki namespace is required to exploit this. * (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as part of its name. == Bugfixes == * (bug T74222) The original patch for T74222 was reverted as unnecessary. * Fixed a couple of entries in RELEASE-NOTES-1.24. * (bug T76168) OutputPage: Add accessors for some protected properties. * (bug T74834) Make 1.24 branch directly installable under PostgreSQL. * Add missing $ in front of variable in OutputPage.php == Security fixes in extensions == * (bug T77624) [SECURITY] Extension:Listings: missing validation in the 'name' and 'url' parameters. * (bug T73111) [SECURITY] Extension:ExpandTemplates: parses user input as wikitext and shows a preview, yet it fails to add an edit token to the form and check it. This can be exploited as an XSS when $wgRawHtml = true. Note this only affects the 1.19/1.22 branches. * (bug T76195) [SECURITY] Extension:TemplateSandbox: Special:TemplateSandbox needs edit token when raw HTML is allowed * (bug T69180) [SECURITY] Extension:Hovercards: XSS in text extracts. * (bug T73167) [SECURITY] Extension:Scribunto allows cross-origin leakage of data from a wiki through timing * (bug T71209) [SECURITY] Extension:TimedMediaHandler: Patch getid3 library for CVE-2014-2053. Full release notes for 1.24.1: <https://www.mediawiki.org/wiki/Release_notes/1.24> Full release notes for 1.23.8: <https://www.mediawiki.org/wiki/Release_notes/1.23> Full release notes for 1.22.15: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.19.23: <https://www.mediawiki.org/wiki/Release_notes/1.19> Public keys: <https://www.mediawiki.org/keys/keys.html> ********************************************************************** 1.24.1 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.tar.gz Patch to previous version (1.24.0): https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.24/mediawiki-core-1.24.1.tar.gz.… https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.24/mediawiki-1.24.1.patch.gz.sig ********************************************************************** 1.23.8 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.tar.gz Patch to previous version (1.23.7): https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.23/mediawiki-core-1.23.8.tar.gz.… https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.23/mediawiki-1.23.8.patch.gz.sig ********************************************************************** 1.22.15 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.tar.gz Patch to previous version (1.22.14): https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.15.tar.gz… https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.15.patch.gz.sig ********************************************************************** 1.19.23 ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.tar.gz Patch to previous version (1.19.22): https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.patch.gz GPG signatures: https://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.23.tar.gz… https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.23.patch.gz.sig Markus Glaser (Wiki Release Team)

1 0

Pre-release announcement for MediaWiki releases 1.24.1, 1.23.8, 1.22.15 and 1.19.23
by Markus Glaser 17 Dec '14

17 Dec '14

Hello everyone, this is a notice that on Wednesday, December 17th, between 19:00-21:00 UTC we will release security and maintenance updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time. Best, Markus Glaser (Wiki Release Team)

1 0

← Newer
1
...
13
14
15
16
17
18
19
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce