Lucene search

K
osvGoogleOSV:DSA-3011-1
HistoryAug 23, 2014 - 12:00 a.m.

mediawiki - security update

2014-08-2300:00:00
Google
osv.dev
6

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

It was discovered that MediaWiki, a website engine for collaborative
work, is vulnerable to JSONP injection in Flash (CVE-2014-5241) and
clickjacking between OutputPage and ParserOutput (CVE-2014-5243). The
vulnerabilities are addressed by upgrading MediaWiki to the new upstream
version 1.19.18, which includes additional changes.

For the stable distribution (wheezy), these problems have been fixed in
version 1:1.19.18+dfsg-0+deb7u1.

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your mediawiki packages.

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P