MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

1 participants
334 discussions

Pre-Release Announcement for MediaWiki 1.19.9, 1.20.8, and 1.21.3
by Chris Steipp 13 Nov '13

13 Nov '13

This is a notice that on Thursday, November 14th between 21:00-22:00 UTC (1-2pm PST) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software, as well as several extensions. Downloads and patches will be available at that time.

1 0

MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8
by Chris Steipp 03 Sep '13

03 Sep '13

I would like to announce the release of MediaWiki 1.21.2, 1.20.7 and 1.19.8. These releases fix 3 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email. * Mozilla, and other developers, reported a full path disclosure in MediaWiki, when an invalid language is specified in ResourceLoader <https://bugzilla.wikimedia.org/show_bug.cgi?id=46332> * An internal review found several API modules allowed anti-CSRF tokens to be accessed via JSONP. <https://bugzilla.wikimedia.org/show_bug.cgi?id=49090> * Andreas Peetz reported an issue with the MediaWiki API where an invalid property name could be used for XSS with older versions of Internet Explorer. <https://bugzilla.wikimedia.org/show_bug.cgi?id=52746> Additionally, the following extensions have been updated to fix security issues: * CentralAuth: An internal review found an authentication regression that allowed an attacker to bypass authentication <https://bugzilla.wikimedia.org/show_bug.cgi?id=52338> * SyntaxHighlight_GeSHi: Mateusz Goik reported an XSS in the included example.php script <https://bugzilla.wikimedia.org/show_bug.cgi?id=49070> * CheckUser: Alex Monk reported and fixed that CheckUser didn't require anti-CSRF tokens for checking users <https://bugzilla.wikimedia.org/show_bug.cgi?id=45019> * Wikibase: Liangent reported and fixed an XSS <https://bugzilla.wikimedia.org/show_bug.cgi?id=53472> * LiquidThreads: Alex Monk reported and fixed an XSS <https://bugzilla.wikimedia.org/show_bug.cgi?id=53320> Full release notes for 1.21.2: <https://www.mediawiki.org/wiki/Release_notes/1.21> Full release notes for 1.20.7: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.8: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.21.2 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.tar.gz Patch to previous version (1.21.1): http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.2.tar.gz.s… http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.2.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.20.7 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.tar.gz Patch to previous version (1.20.6): http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-core-1.20.7.tar.gz.s… http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.7.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** 1.19.8 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.tar.gz Patch to previous version (1.19.7): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.8.tar.gz.s… http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.8.patch.gz.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Extension:CentralAuth ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CentralAuth ********************************************************************** Extension:SyntaxHighlight_GeSHi ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:SyntaxHighlight_GeSHi ********************************************************************** Extension:CheckUser ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:CheckUser ********************************************************************** Extension:Wikibase ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:Wikibase ********************************************************************** Extension:LiquidThreads ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:LiquidThreads

1 0

Pre-Release Announcement for MediaWiki 1.19.8, 1.20.7, and 1.21.2
by Chris Steipp 30 Aug '13

30 Aug '13

This is a notice that on Tuesday, September 3rd between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software, as well as several extensions. Downloads and patches will be available at that time, with the git repositories updated later that afternoon.

1 0

MediaWiki Security Release: 1.20.6 and 1.19.7
by Chris Steipp 21 May '13

21 May '13

I would like to announce the release of MediaWiki 1.20.6 and 1.19.7. These releases fix a security related issue that could affect users of MediaWiki. Download links are given at the end of this email. * MediaWiki user Marco discovered that security checks for file uploads were not being run when the file was uploaded in chunks through the API. This option has been available to users who can upload files since MediaWiki 1.19. <https://bugzilla.wikimedia.org/show_bug.cgi?id=48306> Full release notes for 1.20.6: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.7: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.6 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.6.tar.gz Patch to previous version (1.20.5): http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.6.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.6.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.6.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.7 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.7.tar.gz Patch to previous version (1.19.6): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.7.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.7.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.7.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html

1 0

Pre-Release Announcement for MediaWiki 1.19.7 and 1.20.6
by Chris Steipp 20 May '13

20 May '13

This is a notice that on Tuesday, May 21st between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon. Although MediaWiki does not have the vulnerable feature enabled by default, most wiki using common advanced features will want to patch for this issue.

1 0

MediaWiki Security Release: 1.20.5 and 1.19.6
by Chris Steipp 30 Apr '13

30 Apr '13

I would like to announce the release of MediaWiki 1.20.5 and 1.19.6. These releases fix 2 security related issues that could affect users of MediaWiki. Download links are given at the end of this email. * Jan Schejbal / Hatforce.com reported that SVG script filtering could be bypassed for Chrome and Firefox clients by using an encoding that MediaWiki understood, but these browsers interpreted as UTF-8. <https://bugzilla.wikimedia.org/show_bug.cgi?id=47304> * Internal review discovered that extensions were not given the opportunity to disable a password reset, which could lead to circumvention of two-factor authentication. <https://bugzilla.wikimedia.org/show_bug.cgi?id=46590> Full release notes for 1.20.5: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.6: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.5 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.tar.gz Patch to previous version (1.20.4), without interface text: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.5.patch.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.5.patch.gz… Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.6 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.tar.gz Patch to previous version (1.19.5), without interface text: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.6.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.6.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.6.patch.gz… Public keys: https://secure.wikimedia.org/keys.html

1 0

Pre-Release Announcement for MediaWiki 1.19.6 and 1.20.5
by Chris Steipp 29 Apr '13

29 Apr '13

This is a notice that on Tuesday, April 30th between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon.

1 0

MediaWiki Security Release: 1.20.4 and 1.19.5
by Chris Steipp 15 Apr '13

15 Apr '13

I would like to announce the release of MediaWiki 1.20.4 and 1.19.5. These releases fix 3 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email. * An internal review discovered that specially crafted Lua function names could lead to XSS. <https://bugzilla.wikimedia.org/show_bug.cgi?id=46084> * Daniel Franke reported that during SVG parsing, MediaWiki failed to prevent XML external entity (XXE) processing. This could lead to local file disclosure, or potentially remote command execution in environments that have enabled expect:// handling. <https://bugzilla.wikimedia.org/show_bug.cgi?id=46859> * Internal review also discovered that Special:Import, and Extension:RSS failed to prevent XML external entity (XXE) processing. <https://bugzilla.wikimedia.org/show_bug.cgi?id=47251> Full release notes for 1.20.4: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.5: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.4 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.tar.gz Patch to previous version (1.20.3): http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.4.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.5 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.tar.gz Patch to previous version (1.19.4): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.5.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** Extension:RSS ********************************************************************** Information and Download: https://www.mediawiki.org/wiki/Extension:RSS

1 0

Pre-Release Announcement for MediaWiki 1.19.5 and 1.20.4
by Chris Steipp 12 Apr '13

12 Apr '13

This is a notice that on Monday, April 15th between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon. CVSS scores are between 4.3 and 7.1, most users will want to update.

1 0

MediaWiki security release: 1.20.3 and 1.19.4
by Chris Steipp 04 Mar '13

04 Mar '13

I would like to announce the release of MediaWiki 1.20.3 and 1.19.4. These releases fix 3 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email. * By default, the curl library passed 'true' to CURLOPT_SSL_VERIFYHOST when establishing an SSL connection, instead of '2'. <https://bugzilla.wikimedia.org/show_bug.cgi?id=44135> <https://bugzilla.wikimedia.org/show_bug.cgi?id=42441> * MediaWiki developer Krenair discovered that the full user object, including password hash, could be returned when unblocking a user by the API. Exploitation of this vulnerability requires the user to have permissions to unblock users, by default this is limited to users in the sysop group. <https://bugzilla.wikimedia.org/show_bug.cgi?id=43518> * MediaWiki developer Platonides discovered that the maintenance script mwdoc-filter.php did not check if it was being run via the CLI, and could allow an attacker to read arbitrary files if PHP's register_globals was enabled and the .htaccess file in the maintenance directory, which by default denies access for all users, was disabled. <https://bugzilla.wikimedia.org/show_bug.cgi?id=45355> Full release notes for 1.20.3: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.4: <https://www.mediawiki.org/wiki/Release_notes/1.19> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.3 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.3.tar.gz Patch to previous version (1.20.2), without interface text: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.3.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.3.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.3.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.3.patch.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.3.patch.gz… Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.4 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.4.tar.gz Patch to previous version (1.19.3), without interface text: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.4.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.4.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.4.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.4.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.4.patch.gz… Public keys: https://secure.wikimedia.org/keys.html

1 0

← Newer
1
...
18
19
20
21
22
23
24
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce