MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

1 participants
332 discussions

Pre-release announcement for MediaWiki releases 1.22.4, 1.21.7, 1.19.13
by Mark A. Hershberger 10 Mar '14

10 Mar '14

Mark y Markus (MyM) will release new tarballs on March 11th, 2014 at 23:00 UTC to address:the following issues: * Bundled extensions had the wrong branch * 1.19.13 will include a backported security fix (CVE-2014-2244) that was not included int 1.19.12 Thanks, Mark. -- Mark A. Hershberger NicheWork LLC 717-271-1084

1 0

MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12
by Markus Glaser 28 Feb '14

28 Feb '14

Hello everyone, I would like to announce the release of MediaWiki 1.22.3, 1.21.6 and 1.19.12. These releases fix a number of security related bugs that could affect users of MediaWiki. In addition, MediaWiki 1.22.3 is a maintenance release. It fixes several bugs. You can consult the RELEASE-NOTES-1.22 file for the full list of changes in this version. Download links are given at the end of this email. == Security fixes == * (bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted namespaces. Also disallow iframe elements. User will get an error including the namespace name if they use a non- whitelisted namespace. * (bug 61346) SECURITY: Make token comparison use constant time. It seems like our token comparison would be vulnerable to timing attacks. This will take constant time. * (bug 61362) SECURITY: API: Don't find links in the middle of api.php links. == Bug fixes in 1.22.3 == * (bug 53710) Add sequence support for upsert in DatabaseOracle in the same way as in selectInsert * (bug 60231, 58719) Various fixes to job running code in Wiki.php: Make it async on Windows. Fixed possible "invalid filename" errors on Windows. Redirect output to dev/null to avoid hanging PHP. * (bug 60083) Correct sequence name for fresh Postgres installation. Spotted by gebhkla * (bug 60531) Avoid variable naming conflicts in DatabasePostgres::selectSQLText. Spotted by gebhkla * (bug 60094) Fix rebuildall.php fatal error with PostgreSQL. The fix for 47055 introduced a fatal error when running rebuildall.php. This is a workaround suggested by gebhkla on Bugzilla. It just checks to make sure $options is actually an array before calling array_search on it. * (bug 43817c12) Add error handling if descriptionmsg isn't defined for extension. * (bug 60543) Special:PrefixIndex omits stripprefix=1 for "Next page" link. Full release notes for 1.22.3: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.21.6: <https://www.mediawiki.org/wiki/Release_notes/1.21> Full release notes for 1.19.12: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.22.3 ********************************************************************** Download: http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.3.tar.gz Patch to previous version (1.22.2), without interface text: http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.3.patch.gz Interface text changes: http://releases.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.3.patch.gz GPG signatures: http://releases.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.3.tar.gz.s… http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.3.tar.gz.sig http://releases.wikimedia.org/mediawiki/1.22/mediawiki-1.22.3.patch.gz.sig http://releases.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.3.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.21.6 ********************************************************************** Download: http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.6.tar.gz Patch to previous version (1.21.3), without interface text: http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.6.patch.gz Interface text changes: http://releases.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.6.patch.gz GPG signatures: http://releases.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.6.tar.gz.s… http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.6.tar.gz.sig http://releases.wikimedia.org/mediawiki/1.21/mediawiki-1.21.6.patch.gz.sig http://releases.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.6.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.19.12 ********************************************************************** Download: http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.12.tar.gz Patch to previous version (1.19.11), without interface text: http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.12.patch.gz Interface text changes: http://releases.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.12.patch.gz GPG signatures: http://releases.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.12.tar.gz.… http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.12.tar.gz.sig http://releases.wikimedia.org/mediawiki/1.19/mediawiki-1.19.12.patch.gz.sig http://releases.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.12.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html --mglaser

1 0

MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11
by Chris Steipp 28 Jan '14

28 Jan '14

I would like to announce the release of MediaWiki 1.22.2, 1.21.5 and 1.19.11. Your MediaWiki installation is affected by a remote code execution vulnerability if you have enabled file upload support for DjVu (natively supported by MediaWiki) or PDF files (in combination with the PdfHandler extension). Neither file type is enabled by default in MediaWiki installations. If you are affected, we strongly urge you to update immediately. Affected supported versions: All == Security fixes == * Netanel Rubin from Check Point discovered a remote code execution vulnerability in MediaWiki's thumbnail generation for DjVu files. Internal review also discovered similar logic in the PdfHandler extension, which could be exploited in a similar way. (CVE-2014-1610) <https://bugzilla.wikimedia.org/show_bug.cgi?id=60339> == Bug Fixes in 1.22.2 == * (bug 58253) Check for very old PCRE versions in installer and updater * (bug 60054) Make WikiPage::$mPreparedEdit public Full release notes for 1.22.1: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.21.4: <https://www.mediawiki.org/wiki/Release_notes/1.21> Full release notes for 1.19.9: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.22.2 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.tar.gz Patch to previous version (1.22.1): http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.2.tar.gz.s… http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.patch.gz.sig http://download.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.2.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.21.5 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.tar.gz Patch to previous version (1.21.4): http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.5.tar.gz.s… http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.patch.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.5.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.19.11 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.tar.gz Patch to previous version (1.19.10): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.11.tar.gz.… http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.11.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Extension:PdfHandler ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:PdfHandler

1 0

Pre-Release Announcement for MediaWiki 1.22.2, 1.21.5, and 1.19.11
by Chris Steipp 28 Jan '14

28 Jan '14

This is a notice that on Tuesday, Jan 28th between 21:00-22:00 UTC (1-2pm PST) Wikimedia Foundation will release critical security updates for current and supported branches of the MediaWiki software and extensions. Downloads and patches will be available at that time, with the git repositories updated soon after. The vulnerable feature is not enabled in MediaWiki by default, however many sites will want to upgrade as soon as the patch is available.

1 0

MediaWiki Security Releases: 1.22.1, 1.21.4 and 1.19.10
by Chris Steipp 14 Jan '14

14 Jan '14

I would like to announce the release of MediaWiki 1.22.1, 1.21.4 and 1.19.10. These releases fix a number of security related bugs that could affect users of MediaWiki. In addition, MediaWiki 1.22.1 is a maintenance release. It fixes several bugs. You can consult the RELEASE-NOTES-1.22 file for the full list of changes in this version. Download links are given at the end of this email. == Security fixes == * MediaWiki user Michael M reported that the fix for bug 55332 (CVE-2013-4568) allowed insertion of escaped CSS values which could pass the CSS validation checks, resulting in XSS. (CVE-2013-6451) <https://bugzilla.wikimedia.org/show_bug.cgi?id=58088> * Chris from RationalWiki reported that SVG files could be uploaded that include external stylesheets, which could lead to XSS when an XSL was used to include JavaScript. (CVE-2013-6452) <https://bugzilla.wikimedia.org/show_bug.cgi?id=57550> * During internal review, it was discovered that MediaWiki's SVG sanitization could be bypassed when the XML was considered invalid. (CVE-2013-6453) <https://bugzilla.wikimedia.org/show_bug.cgi?id=58553> * Durign internal review, it was discovered that MediaWiki's CSS sanitization did not filter -o-link attributes, which could be used to execute JavaScript in Opera 12. (CVE-2013-6454) <https://bugzilla.wikimedia.org/show_bug.cgi?id=58472> * During internal review, it was discovered that MediaWiki displayed some information about deleted pages in the log API, enhanced RecentChanges, and user watchlists. (CVE-2013-6472) <https://bugzilla.wikimedia.org/show_bug.cgi?id=58699> Additionally, the following extensions have been updated to fix security issues: * TimedMediaHandler: Bawolff discovered an XSS vulnerability with the way the extension stored and used HTML for showing videos. (CVE-2013-4574) <https://bugzilla.wikimedia.org/show_bug.cgi?id=56699> * Scribuntu: Internal review found a NULL pointer dereference in php-luasandbox, which could be used for DoS attacks. (CVE-2013-4570) <https://bugzilla.wikimedia.org/show_bug.cgi?id=54527> * Scribuntu: Internal review found a Buffer Overflow in php-luasandbox. It's not know if this could be use for code execution on the server. (CVE-2013-4571) <https://bugzilla.wikimedia.org/show_bug.cgi?id=49705> * CentralAuth: Eran Roz reported that MediaWiki usernames could be leaked to other websites. Javascript returned for CentralAuth's login would update the page DOM with the username, even when included on other sites. (CVE-2013-6455) <https://bugzilla.wikimedia.org/show_bug.cgi?id=57081> * SemanticForms: Ravindra Singh Rathore reported a missing CSRF check to Mozilla, who reported the issue to us. Several other forms in the extension were also fixed. <https://bugzilla.wikimedia.org/show_bug.cgi?id=57025> == Bug fixes in 1.22.1 == * (bug 59945) 1.22 tarball offers Extension SimpleAntiSpam which is supposed to be in core. * (bug 58178) Restore compatibility with curl < 7.16.2. * (bug 56931) Updated the plural rules to CLDR 24. They are in new format which is detailed in UTS 35 Rev 33. The PHP parser and evaluator as well as the JavaScript evaluator were updated to support the new format. Plural rules for some languages have changed, most notably Russian. Affected software messages have been updated and marked for review at translatewiki.net. This change is backported from the development branch of MediaWiki 1.23. * (bug 58434) The broken installer for database backend Oracle was fixed. * (bug 58167) The web installer no longer throws an exception when PHP is compiled without support for MySQL yet with support for another DBMS. * (bug 58640) Fixed a compatibility issue with PCRE 8.34 that caused pages to appear blank or with missing text. * (bug 47055) Changed FOR UPDATE handling in Postgresql Full release notes for 1.22.1: <https://www.mediawiki.org/wiki/Release_notes/1.22> Full release notes for 1.21.4: <https://www.mediawiki.org/wiki/Release_notes/1.21> Full release notes for 1.19.9: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.22.1 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.1.tar.gz Patch to previous version (1.22.0), without interface text: http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.1.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.1.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.1.tar.gz.s… http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.1.tar.gz.sig http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.1.patch.gz.sig http://download.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.1.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.21.4 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.4.tar.gz Patch to previous version (1.21.3), without interface text: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.4.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.4.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.4.tar.gz.s… http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.4.tar.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.4.patch.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.4.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.19.10 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.10.tar.gz Patch to previous version (1.19.9), without interface text: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.10.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.10.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.10.tar.gz.… http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.10.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.10.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.10.patch.g… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Extension:TimedMediaHandler ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:TimedMediaHandler ********************************************************************** Extension:Scribunto ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Scribunto ********************************************************************** Extension:CentralAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CentralAuth ********************************************************************** Extension:SemanticForms ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:SemanticForms

1 0

Pre-Release Announcement for MediaWiki 1.19.10, 1.21.4, and 1.22.1
by Chris Steipp 11 Jan '14

11 Jan '14

This is a notice that on Tuesday, January 14th between 00:00-01:00 UTC (*Monday* January 13th, 4-5pm PST) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software, as well as several extensions. Downloads and patches will be available at that time.

1 0

MediaWiki 1.22.0 released
by Markus Glaser 06 Dec '13

06 Dec '13

Dear all, I am happy to announce the availability of the first stable release of the new MediaWiki 1.22 release series. MediaWiki 1.22 is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users. You can consult the RELEASE-NOTES-1.22 file for the full list of changes in this version. Our thanks to everyone who helped to improve MediaWiki by testing the release candidates and submitting bug reports. == What's new? == MediaWiki 1.22 includes all changes released in the smaller 1.22wmfX software deployments to Wikimedia sites. === Anti-spam and countervandalism improvements === We're improving countervandalism and anti-spam features: * The patrolling system has been improved to make the "mark as patrolled" link available on any patrollable page or revision, without having to go to Special:RecentChanges or Special:NewPages. It is no longer necessary to look up the "rcid" URI parameter from these special pages. (Bug 15936) * Extension:SimpleAntiSpam, a small but harmless shield against the simplest forms of spambots, has been merged into core. ===Editing improvements=== * When comparing revisions in the history or when previewing changes while editing, "(No difference)" is now shown in place of a diff when the revisions are identical. (Bug 14431) * After a successful edit, the confirmation message "Your edit was saved." is now shown. Formerly a separate extension (Extension:PostEdit), this feature is now part of the core software. (Bug 48276) ===Upgrades to Vector and other skins=== The old Vector extension has been merged into core, and the extension has been discontinued. The new version includes several improvements to both the Vector skin and cross-skin features. (Bug 45051) If you were previously using the Vector extension, you must uninstall it (the extension, not the skin) before upgrading to 1.22. All skins: * Section edit links are now displayed next to their respective headings rather than along the opposite side of the page. (Bug 41729) * Lists of templates and categories used on the page, displayed below the edit form, are now collapsible. The area with license information, edit summary, and related functionality below the edit field has received a minor graphical lift. (Bug 43689) * An "edit warning" is now displayed when the user attempts to leave the edit page with unsaved changes, on browsers supporting dialogs. * Vector skin only: ** Navigation menu subsections are now collapsible. ** Page tabs can now dynamically fold into a dropdown menu when the browser window isn't wide enough to fit them. ===Support for Composer=== The Composer PHP dependency manager can now be used to install some extensions. It solves many common problems, including finding where to download an extension, resolving all of its dependencies and libraries, and selecting the right versions. Most MediaWiki extensions do not currently support Composer, but this is expected to change. ==Upgrade notices for MediaWiki administrators== As with every release, there are some routine maintenance and upgrade tasks that go beyond the primary installation process. ===PHP JSON extension now required=== Though the minimum PHP version is still 5.3.2, MediaWiki now requires either the native JSON extension or the pecl-json-c fork. Most servers already have this PHP extension installed and enabled. However, if you administer your own server, and the MediaWiki installer says you don't have this extension: * If you compiled PHP yourself with the --disable-all configure option, you may have to recompile with --enable-json. * On Red Hat or CentOS, check for the line extension=json.so in /etc/php.ini or /etc/php.d/json.ini. * Ubuntu 13.10, Fedora 19, and other recent Linux distributions package pecl-json-c separately, under names such as php5-json (Ubuntu universe) and php-pecl-jsonc (Fedora). They no longer include the original JSON extension because of licensing concerns. === Several ancient skins removed === On April 1, 2013, several ancient skins were removed from core (not an April Fools' joke): Chick, Classic, MySkin, Nostalgia and Simple. Nostalgia was the phase I/UseModWiki-like skin, and Classic was the main skin before the introduction of the default MonoBook in MediaWiki 1.3 on May 22, 2004. Dating back to February 2002 both skins existed over a year before MediaWiki got its name. === Blank system messages must be deleted === Blanking a system message (editing it on wiki to remove all content) will no longer restore the default value for the message, but instead make it show as an empty string in the interface (fixing Bug 14176, "Add ability to disable MediaWiki messages"). If you have blank messages on your wiki (check Special:AllMessages), you must delete them unless you want them to display as empty. ===Protection rights usage has changed=== A new setting ($wgCascadingRestrictionLevels) was added for enabling cascading protection for protection levels other than "Allow only administrators" (Bug 47617). Shortly afterward, the way the "editprotected" and "autoconfirmed" rights work was changed. In particular, the "autoconfirmed" right is now only used for rate limiting, not page protection. If your wiki has custom user groups with the "autoconfirmed" right, you may need to grant those groups the new "editsemiprotected" right when you upgrade. ===Special:Disambiguations has been removed=== Special:Disambiguations, a page that listed "Pages linking to disambiguation pages", has been removed (Bug 35981). If your wiki used this feature, consider using Extension:Disambiguator. Switching to the new extension is easy and generally only requires a small change to a single template. === Bundled extensions === Newly bundled for 1.22: * SimpleAntiSpam Full release notes: https://git.wikimedia.org/blob/mediawiki%2Fcore.git/1.22.0/RELEASE-NOTES-1.… https://www.mediawiki.org/wiki/Release_notes/1.22 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.0.tar.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ---- Markus (mglaser)

1 0

MediaWiki Security Release: 1.21.3, 1.20.8 and 1.19.9
by Chris Steipp 14 Nov '13

14 Nov '13

I would like to announce the release of MediaWiki 1.21.3, 1.20.8 and 1.19.9. These releases fix 2 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email. * Kevin Israel (Wikipedia user PleaseStand) identified and reported two vectors for injecting Javascript in CSS that bypassed MediaWiki's blacklist (CVE-2013-4567, CVE-2013-4568). <https://bugzilla.wikimedia.org/show_bug.cgi?id=55332> * Internal review while debugging a site issue discovered that MediaWiki and the CentralNotice extension were incorrectly setting cache headers when a user was autocreated, causing the user's session cookies to be cached, and returned to other users (CVE-2013-4572). <https://bugzilla.wikimedia.org/show_bug.cgi?id=53032> Additionally, the following extensions have been updated to fix security issues: * CleanChanges: MediaWiki steward Teles reported that revision-deleted IP's are not correctly hidden when this extension is used (CVE-2013-4569). <https://bugzilla.wikimedia.org/show_bug.cgi?id=54294> * ZeroRatedMobileAccess: Tomasz Chlebowski reported an XSS vulnerability (CVE-2013-4573). <https://bugzilla.wikimedia.org/show_bug.cgi?id=55991> * CentralAuth: MediaWiki developer Platonides reported a login CSRF in CentralAuth (CVE-2012-5394). <https://bugzilla.wikimedia.org/show_bug.cgi?id=40747> Full release notes for 1.21.3: <https://www.mediawiki.org/wiki/Release_notes/1.21> Full release notes for 1.20.8: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.9: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.21.3 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.3.tar.gz Patch to previous version (1.21.2), without interface text: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.3.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.3.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.3.tar.gz.s… http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.3.tar.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.3.patch.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.3.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.20.8 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.8.tar.gz Patch to previous version (1.20.7), without interface text: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.8.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.8.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-core-1.20.8.tar.gz.s… http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.8.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.8.patch.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.8.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.19.9 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.9.tar.gz Patch to previous version (1.19.8), without interface text: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.9.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.9.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.9.tar.gz.s… http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.9.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.9.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.9.patch.gz… Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Extension:CentralAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CentralAuth ********************************************************************** Extension:CentralNotice ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CentralNotice ********************************************************************** Extension:CleanChanges ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CleanChanges ********************************************************************** Extension:ZeroRatedMobileAccess ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:ZeroRatedMobileAccess

1 0

Pre-Release Announcement for MediaWiki 1.19.9, 1.20.8, and 1.21.3
by Chris Steipp 13 Nov '13

13 Nov '13

This is a notice that on Thursday, November 14th between 21:00-22:00 UTC (1-2pm PST) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software, as well as several extensions. Downloads and patches will be available at that time.

1 0

MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8
by Chris Steipp 03 Sep '13

03 Sep '13

I would like to announce the release of MediaWiki 1.21.2, 1.20.7 and 1.19.8. These releases fix 3 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email. * Mozilla, and other developers, reported a full path disclosure in MediaWiki, when an invalid language is specified in ResourceLoader <https://bugzilla.wikimedia.org/show_bug.cgi?id=46332> * An internal review found several API modules allowed anti-CSRF tokens to be accessed via JSONP. <https://bugzilla.wikimedia.org/show_bug.cgi?id=49090> * Andreas Peetz reported an issue with the MediaWiki API where an invalid property name could be used for XSS with older versions of Internet Explorer. <https://bugzilla.wikimedia.org/show_bug.cgi?id=52746> Additionally, the following extensions have been updated to fix security issues: * CentralAuth: An internal review found an authentication regression that allowed an attacker to bypass authentication <https://bugzilla.wikimedia.org/show_bug.cgi?id=52338> * SyntaxHighlight_GeSHi: Mateusz Goik reported an XSS in the included example.php script <https://bugzilla.wikimedia.org/show_bug.cgi?id=49070> * CheckUser: Alex Monk reported and fixed that CheckUser didn't require anti-CSRF tokens for checking users <https://bugzilla.wikimedia.org/show_bug.cgi?id=45019> * Wikibase: Liangent reported and fixed an XSS <https://bugzilla.wikimedia.org/show_bug.cgi?id=53472> * LiquidThreads: Alex Monk reported and fixed an XSS <https://bugzilla.wikimedia.org/show_bug.cgi?id=53320> Full release notes for 1.21.2: <https://www.mediawiki.org/wiki/Release_notes/1.21> Full release notes for 1.20.7: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.8: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.21.2 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.tar.gz Patch to previous version (1.21.1): http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.2.tar.gz.s… http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.20.7 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.tar.gz Patch to previous version (1.20.6): http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-core-1.20.7.tar.gz.s… http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.19.8 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.tar.gz Patch to previous version (1.19.7): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.8.tar.gz.s… http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Extension:CentralAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CentralAuth ********************************************************************** Extension:SyntaxHighlight_GeSHi ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:SyntaxHighlight_GeSHi ********************************************************************** Extension:CheckUser ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CheckUser ********************************************************************** Extension:Wikibase ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Wikibase ********************************************************************** Extension:LiquidThreads ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:LiquidThreads

1 0

← Newer
1
...
17
18
19
20
21
22
23
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce