MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

1 participants
332 discussions

Pre-Release Announcement for MediaWiki 1.19.8, 1.20.7, and 1.21.2
by Chris Steipp 30 Aug '13

30 Aug '13

This is a notice that on Tuesday, September 3rd between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software, as well as several extensions. Downloads and patches will be available at that time, with the git repositories updated later that afternoon.

1 0

MediaWiki Security Release: 1.20.6 and 1.19.7
by Chris Steipp 21 May '13

21 May '13

I would like to announce the release of MediaWiki 1.20.6 and 1.19.7. These releases fix a security related issue that could affect users of MediaWiki. Download links are given at the end of this email. * MediaWiki user Marco discovered that security checks for file uploads were not being run when the file was uploaded in chunks through the API. This option has been available to users who can upload files since MediaWiki 1.19. <https://bugzilla.wikimedia.org/show_bug.cgi?id=48306> Full release notes for 1.20.6: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.7: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.6 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.6.tar.gz Patch to previous version (1.20.5): http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.6.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.6.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.6.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.7 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.7.tar.gz Patch to previous version (1.19.6): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.7.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.7.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.7.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html

1 0

Pre-Release Announcement for MediaWiki 1.19.7 and 1.20.6
by Chris Steipp 20 May '13

20 May '13

This is a notice that on Tuesday, May 21st between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon. Although MediaWiki does not have the vulnerable feature enabled by default, most wiki using common advanced features will want to patch for this issue.

1 0

MediaWiki Security Release: 1.20.5 and 1.19.6
by Chris Steipp 30 Apr '13

30 Apr '13

I would like to announce the release of MediaWiki 1.20.5 and 1.19.6. These releases fix 2 security related issues that could affect users of MediaWiki. Download links are given at the end of this email. * Jan Schejbal / Hatforce.com reported that SVG script filtering could be bypassed for Chrome and Firefox clients by using an encoding that MediaWiki understood, but these browsers interpreted as UTF-8. <https://bugzilla.wikimedia.org/show_bug.cgi?id=47304> * Internal review discovered that extensions were not given the opportunity to disable a password reset, which could lead to circumvention of two-factor authentication. <https://bugzilla.wikimedia.org/show_bug.cgi?id=46590> Full release notes for 1.20.5: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.6: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.5 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.tar.gz Patch to previous version (1.20.4), without interface text: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.patch.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.5.patch.gz… Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.6 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.tar.gz Patch to previous version (1.19.5), without interface text: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.6.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.6.patch.gz… Public keys: https://secure.wikimedia.org/keys.html

1 0

Pre-Release Announcement for MediaWiki 1.19.6 and 1.20.5
by Chris Steipp 29 Apr '13

29 Apr '13

This is a notice that on Tuesday, April 30th between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon.

1 0

MediaWiki Security Release: 1.20.4 and 1.19.5
by Chris Steipp 15 Apr '13

15 Apr '13

I would like to announce the release of MediaWiki 1.20.4 and 1.19.5. These releases fix 3 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email. * An internal review discovered that specially crafted Lua function names could lead to XSS. <https://bugzilla.wikimedia.org/show_bug.cgi?id=46084> * Daniel Franke reported that during SVG parsing, MediaWiki failed to prevent XML external entity (XXE) processing. This could lead to local file disclosure, or potentially remote command execution in environments that have enabled expect:// handling. <https://bugzilla.wikimedia.org/show_bug.cgi?id=46859> * Internal review also discovered that Special:Import, and Extension:RSS failed to prevent XML external entity (XXE) processing. <https://bugzilla.wikimedia.org/show_bug.cgi?id=47251> Full release notes for 1.20.4: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.5: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.4 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.tar.gz Patch to previous version (1.20.3): http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.5 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.tar.gz Patch to previous version (1.19.4): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** Extension:RSS ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:RSS

1 0

Pre-Release Announcement for MediaWiki 1.19.5 and 1.20.4
by Chris Steipp 12 Apr '13

12 Apr '13

This is a notice that on Monday, April 15th between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon. CVSS scores are between 4.3 and 7.1, most users will want to update.

1 0

MediaWiki security release: 1.20.3 and 1.19.4
by Chris Steipp 04 Mar '13

04 Mar '13

I would like to announce the release of MediaWiki 1.20.3 and 1.19.4. These releases fix 3 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email. * By default, the curl library passed 'true' to CURLOPT_SSL_VERIFYHOST when establishing an SSL connection, instead of '2'. <https://bugzilla.wikimedia.org/show_bug.cgi?id=44135> <https://bugzilla.wikimedia.org/show_bug.cgi?id=42441> * MediaWiki developer Krenair discovered that the full user object, including password hash, could be returned when unblocking a user by the API. Exploitation of this vulnerability requires the user to have permissions to unblock users, by default this is limited to users in the sysop group. <https://bugzilla.wikimedia.org/show_bug.cgi?id=43518> * MediaWiki developer Platonides discovered that the maintenance script mwdoc-filter.php did not check if it was being run via the CLI, and could allow an attacker to read arbitrary files if PHP's register_globals was enabled and the .htaccess file in the maintenance directory, which by default denies access for all users, was disabled. <https://bugzilla.wikimedia.org/show_bug.cgi?id=45355> Full release notes for 1.20.3: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.4: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.3 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.3.tar.gz Patch to previous version (1.20.2), without interface text: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.3.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.3.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.3.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.3.patch.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.3.patch.gz… Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.4 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.4.tar.gz Patch to previous version (1.19.3), without interface text: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.4.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.4.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.4.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.4.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.4.patch.gz… Public keys: https://secure.wikimedia.org/keys.html

1 0

Pre-Release Announcement for MediaWiki 1.19.4 and 1.20.3
by Chris Steipp 01 Mar '13

01 Mar '13

This is a notice to let you know that on Monday, March 4th between 21:00-22:00 UTC (1-2pm PST) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon.

1 0

MediaWiki maintenance release 1.20.2
by Chris Steipp 04 Dec '12

04 Dec '12

I would like to announce the release of MediaWiki 1.20.2. This is a maintenance release correcting issues from the 1.20.1 security release. * (bug 42638) Fixes action=options&reset=1 in the API, and fixes unit tests. * (bug 42370) Fixes backport of 60cc060 to use mDoneWrites instead of mTrxDoneWrites. Full release notes: <https://www.mediawiki.org/wiki/Release_notes/1.20> ********************************************************************** Download: <http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.2.tar.gz> Patch to previous version (1.20.1): <http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.2.patch.gz> GPG signatures: <http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.2.tar.gz.sig> <http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.2.patch.gz.sig> Public keys: <https://secure.wikimedia.org/keys.html>

1 0

← Newer
1
...
18
19
20
21
22
23
24
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce