[Backports-security-announce] Security Update for mediawiki

Gerfried Fuchs uploaded new packages for mediawiki which fixed the
following security problems:

CVE-2008-5249, Debian BTS #508868

Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through
1.13.2 allows remote attackers to inject arbitrary web script or HTML
via unspecified vectors.

CVE-2008-5250, Debian BTS #508869

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11,
1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer
is used and uploads are enabled, or an SVG scripting browser is used
and SVG uploads are enabled, allows remote authenticated users to
inject arbitrary web script or HTML by editing a wiki page.

CVE-2008-5252, Debian BTS #508870

Cross-site request forgery (CSRF) vulnerability in the Special:Import
feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and
1.13.x before 1.13.3 allows remote attackers to perform unspecified
actions as authenticated users via unknown vectors.

CVE-2008-5687

MediaWiki 1.11, and other versions before 1.13.3, does not properly
protect against the download of backups of deleted images, which might
allow remote attackers to obtain sensitive information via requests
for files in images/deleted/.

CVE-2009-0737, Debian BTS #514547

Multiple cross-site scripting (XSS) vulnerabilities in the web-based
installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12
before 1.12.4, and 1.13 before 1.13.4, when the installer is in active
use, allow remote attackers to inject arbitrary web script or HTML via
unspecified vectors.

For the etch-backports distribution the problems have been fixed in
version 1:1.12.0-2lenny3~bpo40+1.

For the squeeze and sid distributions all problems but CVE-2009-0737
(see #514547) have been fixed in version 1:1.13.3-1.

Upgrade instructions

If you don't use pinning (see [1]) you have to update the packages
manually via "apt-get -t etch-backports install <packagelist>" with the
packagelist of your installed packages affected by this update.
[1] <http://backports.org/dokuwiki/doku.php?id=instructions&gt;

We recommend to pin the backports repository to 200 so that new versions
of installed backports will be installed automatically:

Package: *
Pin: release a=etch-backports
Pin-Priority: 200