MediaWiki < 1.23.11 / 1.24.4 / 1.25.3 Multiple Vulnerabilities

The version of MediaWiki installed is 1.23.x earlier than 1.23.11, 1.24.x earlier than 1.24.4, or 1.25.x earlier than 1.25.3. Therefore, it is affected by multiple vulnerabilities :

• A flaw exists in the Chunked Upload API that is due to the program failing to stop adding new chunks to the upload when the reported size was exceeded. This may allow a remote attacker to upload a potentially infinite number of chunks for a single file upload and exhaust available disk space on the server. (CVE-2015-8001)
• A flaw in the Chunked Upload API may allow a remote attacker to upload files in chunks of 1 byte. This may allow the attacker to create an excessively large number of files on the server. (CVE-2015-8002)
• A flaw exists due to a missing file upload throttling feature, which can allow remote attackers to cause excessive stress on the server. (CVE-2015-8003)
• A flaw exists that is triggered as authorization checks are missing when removing a suppression from a revision. This may allow an unauthorized, but authenticated, remote attacker to remove a revision suppression. (CVE-2015-8004)
• A flaw exists that is triggered as thumbnails of PNG files that are created with ImageMagick contain potentially sensitive information. This may allow a remote attacker to gain access to local file path information. (CVE-2015-8005)