MediaWiki-announce

mediawiki-announce@lists.wikimedia.org

1 participants
334 discussions

Pre-Release Announcement for MediaWiki 1.19.4 and 1.20.3
by Chris Steipp 01 Mar '13

01 Mar '13

This is a notice to let you know that on Monday, March 4th between 21:00-22:00 UTC (1-2pm PST) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon.

1 0

MediaWiki maintenance release 1.20.2
by Chris Steipp 05 Dec '12

05 Dec '12

I would like to announce the release of MediaWiki 1.20.2. This is a maintenance release correcting issues from the 1.20.1 security release. * (bug 42638) Fixes action=options&reset=1 in the API, and fixes unit tests. * (bug 42370) Fixes backport of 60cc060 to use mDoneWrites instead of mTrxDoneWrites. Full release notes: <https://www.mediawiki.org/wiki/Release_notes/1.20> ********************************************************************** Download: <http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.2.tar.gz> Patch to previous version (1.20.1): <http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.2.patch.gz> GPG signatures: <http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.2.tar.gz.sig> <http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.2.patch.gz.sig> Public keys: <https://secure.wikimedia.org/keys.html>

1 0

MediaWiki security release: 1.20.1, 1.19.3 and 1.18.6
by Chris Steipp 30 Nov '12

30 Nov '12

I would like to announce the release of MediaWiki 1.20.1, 1.19.3 and 1.18.6. These releases fix 3 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email . Please note that support for the MediaWiki 1.18 branch ends this month. * During an internal review, it was discovered that MediaWiki core is vulnerable to session fixation attacks. Successful exploitation could allow an attacker to compromise another user's account. This issues has been assigned CVE-2012-5391. A similar vulnerability was also identified in the CentralAuth Extension, and assigned CVE-2012-5395. <https://bugzilla.wikimedia.org/show_bug.cgi?id=40995> <https://bugzilla.wikimedia.org/show_bug.cgi?id=40962> * Wikipedia user PleaseStand discovered that a new API feature in MediaWiki 1.20 allowed for HTML code to be injected into the "editfont" option. Since this option only affects the current user, exploitation for XSS is difficult. However, users of MediaWiki 1.20 are encouraged to upgrade. <https://bugzilla.wikimedia.org/show_bug.cgi?id=42202> * Wikipedia user PleaseStand discovered that a PCRE backtrack limit could easily be exceeded, causing recent changes and history pages to fail to display. Since these pages are often used for fighting spam and vandalism, public wikis are encouraged to update. <https://bugzilla.wikimedia.org/show_bug.cgi?id=41400> Full release notes for 1.20.1: <https://www.mediawiki.org/wiki/Release_notes/1.20> Full release notes for 1.19.3: <https://www.mediawiki.org/wiki/Release_notes/1.19> Full release notes for 1.18.6: <https://www.mediawiki.org/wiki/Release_notes/1.18> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.20.1 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.1.tar.gz Patch to previous version (1.20.0), without interface text: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.1.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.1.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.1.tar.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.1.patch.gz.sig http://download.wikimedia.org/mediawiki/1.20/mediawiki-i18n-1.20.1.patch.gz… Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.19.3 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.3.tar.gz Patch to previous version (1.19.2), without interface text: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.3.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.3.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.3.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.3.patch.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.3.patch.gz… Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.18.6 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.6.tar.gz Patch to previous version (1.18.5): http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.6.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.6.tar.gz.sig http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.6.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** Extension:CentralAuth ********************************************************************** Information and Download: http://www.mediawiki.org/wiki/Extension:CentralAuth

1 0

Pre-Release Announcement for MediaWiki 1.18.6, 1.19.3, and 1.20.1
by Chris Steipp 28 Nov '12

28 Nov '12

On Thursday, November 29th, between 21:00-22:00 UTC (1-2pm PST) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. We are providing this pre-announcement as a courtesy for administrators to be ready to accept the fix for these on Thursday. We will send another announcement email when the patches and tar files are ready for download. * Vulnerabilities were found in both MediaWiki core and the CentralAuth extension. Successful exploitation could allow an attacker to compromise another user's account. Risk is considered moderate (CVSS Base Score: 4). * One vulnerability was discovered that could allow an attacker to prevent users from viewing Special:RecentChanges, and other pages, which could prevent the detection of SPAM or vandalism. Public wikis are encouraged to upgrade. * A flaw in the MediaWiki 1.20 API could allow a stored XSS. Exploitation requires user interaction or an existing XSS vulnerability, so risk of exploitation is low. For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading>

1 0

MediaWiki 1.20.0 released
by Mark A. Hershberger 07 Nov '12

07 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm happy to announce the availability of the first stable release of the new MediaWiki 1.20 release series. MediaWiki 1.20 is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users. You can consult the RELEASE-NOTES-1.20 file for the full list of changes in this version. Our thanks go to everyone who helped to improve MediaWiki by testing the beta release and submitting bug reports. == What's new? == MediaWiki 1.20 brings the usual host of various bugfixes and new features. * Minimum PHP version is now 5.3.2. * New diff view, greatly improved in clarity especially for whitespace and other small changes and color-blind users. * New special page Special:MostInterwikis. * New magic word {{PAGEID}} which gives the current page ID. * The info action has been reimplemented. Internationalization: * New languages supported: Emilian (egl), Tornedalen Finnish (fit), Mizo (lus), Santali (sat), Turoyo (tru) * New Cyrillic-Latin language converter for Uzbek (uz) == What's next? == === Next Release === Since the Wikimedia Foundation has successfully switched to a biweekly release cycle for their sites, making releases of MediaWiki available on a more regular basis makes sense. As of this release, we plan to release a new version of MediaWiki every six months. This means that version 1.21 of MediaWiki will be released in April or May 2013. === Long Term Support === We're working closely with Linux distributors to make sure that the MediaWiki bundled in Linux is something that we feel more comfortable supporting. In this vein, MediaWiki 1.19 is being targeted for "long term support". Since Debian (the Linux distribution with the longest release cycle) has a two year cycle between each freeze and we've gotten MediaWiki 1.19 into Wheezy, we'll support MW 1.19 for the next two years. (Thank you especially to MediaWiki developer Platonides for his help in working with the Debian developers.) Full release notes: https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/core.git;a=blob;f=RELEASE… https://www.mediawiki.org/wiki/Release_notes/1.20 Frequently asked questions about upgrading: http://www.mediawiki.org/wiki/Manual:FAQ#Upgrading ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.20/mediawiki-1.20.0.tar.gz.sig Public keys: https://secure.wikimedia.org/keys.html - -- http://hexmode.com/ Any time you have "one overriding idea", and push your idea as a superior ideology, you're going to be wrong. ... The fact is, reality is complicated -- Linus Torvalds <http://hexm.de/mc> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iD8DBQFQmbfgc17xCi38v/URAmLmAJ9n8ayLP+g1bo2Gv7zcvcI0Nw8W0QCdEaAR s615i/Ft76+xuMWgJ+73P+4= =DLfb -----END PGP SIGNATURE-----

1 0

MediaWiki security release: 1.19.2 and 1.18.5
by Chris Steipp 31 Aug '12

31 Aug '12

I would like to announce the release of MediaWiki 1.19.2 and 1.18.5. These releases fix 6 security related bugs that could affect users of MediaWiki. Download links are given at the end of this email. * Wikipedia administrator Writ Keeper discovered a stored XSS (HTML injection) vulnerability. This was possible due to the handling of link text on File: links for nonexistent files. MediaWiki 1.16 and later is affected. For more details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39700> * User Fomafix reported several DOM-based XSS vulnerabilities, made possible by a combination of loose filtering of the uselang parameter, and JavaScript gadgets on various language Wikipedias. For more details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=37587> * During internal review, it was discovered that CSRF tokens, available via the api, were not protected with X-Frame-Options headers. This could lead to a CSRF vulnerability if the API response is embedded in an external website using an iframe. For more details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39180> * During internal review, it was discovered extensions were not always allowed to prevent the account creation action. This allowed users blocked by the GlobalBlocking extension to create accounts. For more details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39824> * During internal review, it was discovered that password data was always saved to the local MediaWiki database, even if authentication was handled by an extension, such as LDAP. This could allow a compromised MediaWiki installation to leak information about user's LDAP passwords. Additionally, in situations when an authentication plugin returned false in its strict function, this would allow old passwords to be used for accounts that did not exist in the external system, indefinitely. For details on how to clean up the data leakage, see: <https://bugzilla.wikimedia.org/show_bug.cgi?id=39184> * During internal review, it was discovered that metadata about blocks, hidden by a user with suppression rights, was visible to administrators. For more details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39823> Full release notes for 1.19.2: <https://www.mediawiki.org/wiki/Release_notes/1.19> Full release notes for 1.18.5: <https://www.mediawiki.org/wiki/Release_notes/1.18> For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** 1.19.2 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.tar.gz Patch to previous version (1.19.1): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.2.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html ********************************************************************** 1.18.5 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.tar.gz Patch to previous version (1.18.4), without interface text: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.patch.gz Interface text changes: http://download.wikimedia.org/mediawiki/1.18/mediawiki-i18n-1.18.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.5.patch.gz.sig http://download.wikimedia.org/mediawiki/1.18/mediawiki-i18n-1.18.5.patch.gz… Public keys: https://secure.wikimedia.org/keys.html

1 0

MediaWiki security release 1.19.1
by Sam Reed 13 Jun '12

13 Jun '12

I would like to announce the release of MediaWiki 1.19.1. One security issue was discovered. Both Chris Steipp and Formafix discovered that the uselang http parameter was vulnerable to XSS. For more details, see https://bugzilla.wikimedia.org/show_bug.cgi?id=36938 Chris Steipp also improved the blacklisting of bad elements in SVG files. This includes catching known hostile files, and also disallowing the upload of svg files that include remote resources. This is work is part of an on-going effort to prevent exploits being hidden in uploaded SVG files. MediaWiki 1.19.1 also received a couple of other non-security bugfixes. Full release notes: https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/core.git;a=blob_plain;f=RE LEASE-NOTES-1.19;hb=1.19.1 https://www.mediawiki.org/wiki/Release_notes/1.19 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.tar.gz Patch to previous version (1.19.0): http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.tar.gz.sig http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html

1 0

MediaWiki security release 1.18.4
by Sam Reed 13 Jun '12

13 Jun '12

I would like to announce the release of MediaWiki 1.18.4. One security issue was discovered. Both Chris Steipp and Formafix discovered that the uselang http parameter was vulnerable to XSS. For more details, see https://bugzilla.wikimedia.org/show_bug.cgi?id=36938 Chris Steipp also improved the blacklisting of bad elements in SVG files. This includes catching known hostile files, and also disallowing the upload of svg files that include remote resources. This is work is part of an on-going effort to prevent exploits being hidden in uploaded SVG files. Full release notes: https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/core.git;a=blob_plain;f=RE LEASE-NOTES-1.18;hb=1.18.4 https://www.mediawiki.org/wiki/Release_notes/1.18 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.4.tar.gz Patch to previous version (1.18.3): http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.4.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.4.tar.gz.sig http://download.wikimedia.org/mediawiki/1.18/mediawiki-1.18.4.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html

1 0

MediaWiki security release 1.17.5
by Sam Reed 13 Jun '12

13 Jun '12

I would like to announce the release of MediaWiki 1.17.5. One security issue was discovered. Both Chris Steipp and Formafix discovered that the uselang http parameter was vulnerable to XSS. For more details, see https://bugzilla.wikimedia.org/show_bug.cgi?id=36938 Chris Steipp also improved the blacklisting of bad elements in SVG files. This includes catching known hostile files, and also disallowing the upload of svg files that include remote resources. This is work is part of an on-going effort to prevent exploits being hidden in uploaded SVG files. Full release notes: https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/core.git;a=blob_plain;f=RE LEASE-NOTES;hb=1.17.5 https://www.mediawiki.org/wiki/Release_notes/1.17 ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.17/mediawiki-1.17.5.tar.gz Patch to previous version (1.17.4): http://download.wikimedia.org/mediawiki/1.17/mediawiki-1.17.5.patch.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.17/mediawiki-1.17.5.tar.gz.sig http://download.wikimedia.org/mediawiki/1.17/mediawiki-1.17.5.patch.gz.sig Public keys: https://secure.wikimedia.org/keys.html

1 0

MediaWiki 1.19.0 released
by Sam Reed 02 May '12

02 May '12

I'm happy to announce the availability of the first stable release of the new MediaWiki 1.19 release series. MediaWiki 1.19 is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users. You can consult the RELEASE-NOTES-1.19 file for the full list of changes in this version. Our thanks go to everyone who helped to improve MediaWiki by testing the beta release and submitting bug reports. **************************************************************** What's new? **************************************************************** MediaWiki 1.19 brings the usual host of various bugfixes and new features. Comprehensive list of what's new is in the release notes. * Bumped MySQL version requirement to 5.0.2. * Disable the partial HTML and MathML rendering options for Math, and render as PNG by default. * MathML mode was so incomplete most people thought it simply didn't work. * New skins/common/*.css files usable by skins instead of having to copy piles of generic styles from MonoBook or Vector's css. * The default user signature now contains a talk link in addition to the user link. * Searching blocked usernames in block log is now clearer. * Better timezone recognition in user preferences. * Extensions can now participate in the extraction of titles from URL paths. * The command-line installer supports various RDBMSes better. * The interwiki links table can now be accessed also when the interwiki cache is used (used in the API and the Interwiki extension). Internationalization - -------------------- * More gender support (for instance in user lists). * Add languages: Canadian English. * Language converter improved, e.g. it now works depending on the page content language. * Time and number-formatting magic words also now depend on the page content language. * Bidirectional support further improved after 1.18. Full release notes: https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/core.git;a=blob;f=RELEASE- NOTES-1.19;hb=REL1_19 https://www.mediawiki.org/wiki/Release_notes/1.19 Frequently asked questions about upgrading: http://www.mediawiki.org/wiki/Manual:FAQ#Upgrading ********************************************************************** Download: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.0.tar.gz GPG signatures: http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.0.tar.gz.sig Public keys: https://secure.wikimedia.org/keys.html

1 0

← Newer
1
...
19
20
21
22
23
24
25
...
34
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce