MGASA-2014-0113: mediawiki Mageia

Vulnerability summary

MGASA-2014-0113 is a vulnerability in mediawiki Mageia with no CVSS score yet.

Timeline

1. 02-03-2014
   PublishedVulnerability first disclosed.
2. 16-04-2026
   Last modifiedVulnerability information updated.

Description

Updated mediawiki packages fix security vulnerabilities MediaWiki user Michael M reported that the fix for CVE-2013-4568 allowed insertion of escaped CSS values which could pass the CSS validation checks, resulting in XSS (CVE-2013-6451). Chris from RationalWiki reported that SVG files could be uploaded that include external stylesheets, which could lead to XSS when an XSL was used to include JavaScript (CVE-2013-6452). During internal review, it was discovered that MediaWiki's SVG sanitization could be bypassed when the XML was considered invalid (CVE-2013-6453). During internal review, it was discovered that MediaWiki displayed some information about deleted pages in the log API, enhanced RecentChanges, and user watchlists (CVE-2013-6472). Netanel Rubin from Check Point discovered a remote code execution vulnerability in MediaWiki's thumbnail generation for DjVu files. Internal review also discovered similar logic in the PdfHandler extension, which could be exploited in a similar way (CVE-2014-1610). MediaWiki has been updated to version 1.22.2, which fixes these issues, as well as several others. Also, the mediawiki-ldapauthentication and mediawiki-math extensions have been updated to newer versions that are compatible with MediaWiki 1.22. Additionally, the mediawiki-graphviz extension has been obsoleted, due to the fact that it is unmaintained upstream and is vulnerable to cross-site scripting attacks. Note: if you were using the "instances" feature in these packages to support multiple wiki instances, this feature has now been removed. You will need to maintain separate wiki instances manually.

No weakness data has been published for this record.