-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is a security and bugfix release of MediaWiki 1.16.0 and
MediaWiki 1.15.5. Download links are given at the end of this email.
A data leakage vulnerability was discovered, affecting MediaWiki 1.8
and later. Public caching headers were incorrectly set on API
responses containing private data. By means of a CSRF-style attack,
this can lead to the disclosure of various types of private data
stored on a wiki. All users are advised to upgrade. Full details can
be found at:
https://bugzilla.wikimedia.org/show_bug.cgi?id=24565
A cross-site scripting (XSS) vulnerability was discovered in
profileinfo.php. The vulnerability is only exposed when the script is
explicitly enabled in LocalSettings.php, with $wgEnableProfileInfo = true.
A register_globals arbitrary inclusion vulnerability was discovered in
the 1.16 beta release series, in MediaWikiParserTest.php. This
vulnerability does not affect any stable MediaWiki release. It only
affects wikis which have PHP's register_globals feature enabled,
despite our strong advice to the contrary. Apache installations with
AllowOverride enabled may be protected against this vulnerability,
since there is a .htaccess file with "Deny from all" in the relevant path.
In both releases, the interface text was updated with new translations
from translatewiki.net.
Full release notes for 1.15.5:
<http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_15_5/phase3/RELEASE-NO…>
Full release notes for 1.16.0:
<http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_0/phase3/RELEASE-NO…>
Upgrade FAQ:
http://www.mediawiki.org/wiki/Manual:FAQ#Upgrading
**********************************************************************
We are proud to announce the first stable release of the 1.16 series.
Selected changes that may be of interest since MediaWiki 1.15 are:
* Watchlists now have RSS/Atom feeds. RSS feeds generally are now
hidden, since Atom is a better protocol and is supported by virtually
all clients.
* It's now possible to block users from sending email via
Special:Emailuser.
* The maintenance script system was overhauled. Most maintenance
scripts now have a useful help page when you run them with --help.
* AdminSettings.php is no longer required in order to run maintenance
scripts. You can just set $wgDBadminuser and $wgDBadminpassword in
your LocalSettings.php instead.
* The preferences system was overhauled. Preferences are stored in a
more compact format. Changes to site default preferences will
automatically affect all users who have not chosen a different preference.
* Support for SQLite was improved. Some broken features were fixed,
and it now has an efficient full-text search.
* The user groups ACL system was improved by allowing rights to be
revoked, instead of just granted.
* A new localisation caching system was introduced, which will make
MediaWiki faster for almost everyone, especially when lots of
extensions are enabled.
By default, this new system makes a lot of database queries. If your
database is particularly slow, or if your system administrator limits
your query count, or if you want to squeeze as much performance as
possible out of Mediawiki, set $wgCacheDirectory to a writable path on
the local filesystem. Make sure you have the DBA extension for PHP
installed, this will improve performance further.
**********************************************************************
1.15.5
**********************************************************************
Download:
http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.5.tar.gz
Patch to previous version (1.15.4), without interface text:
http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.5.patch.gz
Interface text changes:
http://download.wikimedia.org/mediawiki/1.15/mediawiki-i18n-1.15.5.patch.gz
GPG signatures:
http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.5.tar.gz.sighttp://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.5.patch.gz.sighttp://download.wikimedia.org/mediawiki/1.15/mediawiki-i18n-1.15.5.patch.gz…
Public keys:
https://secure.wikimedia.org/keys.html
**********************************************************************
1.16.0
**********************************************************************
Download:
http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0.tar.gz
Patch to previous version (1.16.0beta3), without interface text:
http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0.patch.gz
Interface text changes:
http://download.wikimedia.org/mediawiki/1.16/mediawiki-i18n-1.16.0.patch.gz
GPG signatures:
http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0.tar.gz.sighttp://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0.patch.gz.sighttp://download.wikimedia.org/mediawiki/1.16/mediawiki-i18n-1.16.0.patch.gz…
Public keys:
https://secure.wikimedia.org/keys.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkxP4e8ACgkQgkA+Wfn4zXkWIgCgmr9dHmPtQqk+2bdQaHkLGss3
7W8AoJqgkJsurVVzWFBkr3TgrswsWzcd
=L7ad
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The first beta release of the 1.16 branch is now available for
download. Please try it and tell us if it works for you. This beta
release is not recommended for use in a production environment.
Selected changes since MediaWiki 1.15 that may be of interest:
* Watchlists now have RSS/Atom feeds. RSS feeds generally are now
hidden, since Atom is a better protocol and is supported by virtually
all clients.
* It's now possible to block users from sending email via
Special:Emailuser.
* The maintenance script system was overhauled. Most maintenance
scripts now have a useful help page when you run them with --help.
* AdminSettings.php is no longer required in order to run maintenance
scripts. You can just set $wgDBadminuser and $wgDBadminpassword in
your LocalSettings.php instead.
* The preferences system was overhauled. Preferences are stored in a
more compact format. Changes to site default preferences will
automatically affect all users who have not chosen a different preference.
* Support for SQLite was improved. Some broken features were fixed,
and it now has an efficient full-text search.
* The user groups ACL system was improved by allowing rights to be
revoked, instead of just granted.
* A new localisation caching system was introduced, which will make
MediaWiki faster for almost everyone, especially when lots of
extensions are enabled.
By default, this new system makes a lot of database queries. If your
database is particularly slow, or if your system administrator limits
your query count, or if you want to squeeze as much performance as
possible out of Mediawiki, set $wgCacheDirectory to a writable path on
the local filesystem. Make sure you have the DBA extension for PHP
installed, this will improve performance further.
Full release notes:
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_0beta1/phase3/RELEA…
**********************************************************************
Download:
http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0beta1.tar.gz
GPG signatures:
http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0beta1.tar.gz.s…
Public keys:
https://secure.wikimedia.org/keys.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkua4+gACgkQgkA+Wfn4zXmEegCfaZ153qv8zNiQk18JNwiTfi3w
NZcAni7Yf8v/lQcctKGya4JH4ow4hAFb
=JK00
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is a security and bugfix release of MediaWiki 1.15.2.
Two security issues were discovered:
A CSS validation issue was discovered which allows editors to display
external images in wiki pages. This is a privacy concern on public
wikis, since a malicious user may link to an image on a server they
control, which would allow that attacker to gather IP addresses and
other information from users of the public wiki. All sites running
publicly-editable MediaWiki installations are advised to upgrade. All
versions of MediaWiki (prior to this one) are affected.
A data leakage vulnerability was discovered in thumb.php which affects
wikis which restrict access to private files using img_auth.php, or
some similar scheme. All versions of MediaWiki since 1.5 are affected.
Deleting thumb.php is a suitable workaround for private wikis which do
not use $wgThumbnailScriptPath or $wgLocalRepo['thumbScriptUrl'].
Alternatively, you can upgrade to MediaWiki 1.15.2 or backport the
patch below to whatever version of MediaWiki you are using.
MediaWiki is not compatible with PHP 5.3.1 due to a bug in that
release, which is fixed in PHP 5.3.2. This release of MediaWiki will
refuse to upgrade if an affected version of PHP is present. Note that
local or distribution-specific backports of the PHP bug fix are
supported. See http://bugs.php.net/50394 for details.
Full release notes:
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_15_2/phase3/RELEASE-NO…
**********************************************************************
Download:
http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.2.tar.gz
Patch to previous version (1.15.1), without interface text:
http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.2.patch.gz
Interface text changes:
http://download.wikimedia.org/mediawiki/1.15/mediawiki-i18n-1.15.2.patch.gz
GPG signatures:
http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.2.tar.gz.sighttp://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.2.patch.gz.sighttp://download.wikimedia.org/mediawiki/1.15/mediawiki-i18n-1.15.2.patch.gz…
Public keys:
https://secure.wikimedia.org/keys.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAkuVjQcACgkQgkA+Wfn4zXkYqACfRXMeQdbHT2ep+xEbkgPpz+BA
5pgAoMhuJQ6UJrW8Wdh/Ji9VA/h8MRH0
=CDe6
-----END PGP SIGNATURE-----