[ MDVSA-2014:083 ] mediawiki

2014-05-10T00:00:00
ID SECURITYVULNS:DOC:30711
Type securityvulns
Reporter Securityvulns
Modified 2014-05-10T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2014:083 http://www.mandriva.com/en/support/security/


Package : mediawiki Date : May 8, 2014 Affected: Business Server 1.0


Problem Description:

Updated mediawiki packages fix security vulnerabilities:

Login CSRF issue in MediaWiki before 1.22.5 in Special:ChangePassword, whereby a user can be logged into an attackers account without being aware of it, allowing the attacker to track the user's activity (CVE-2014-2665).

XSS vulnerability in MediaWiki before 1.22.6, where if the default sort key is set to a string containing a script, the script will be executed when the page is viewed using the info action.

MediaWiki has been updated to version 1.22.6, fixing this and other issues.


References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2665 http://advisories.mageia.org/MGASA-2014-0157.html http://advisories.mageia.org/MGASA-2014-0197.html


Updated Packages:

Mandriva Business Server 1/X86_64: 292fb98c951c1b2111ad9fe0bb26a6d2 mbs1/x86_64/mediawiki-1.22.6-1.mbs1.noarch.rpm 7b12b37abd00c4f4e9cf3987d1305ffb mbs1/x86_64/mediawiki-mysql-1.22.6-1.mbs1.noarch.rpm 2d7eb5e3fba48833afa4ab7c6d7c7f52 mbs1/x86_64/mediawiki-pgsql-1.22.6-1.mbs1.noarch.rpm 854f21c25837fbabf6e44353606e5ba3 mbs1/x86_64/mediawiki-sqlite-1.22.6-1.mbs1.noarch.rpm 16c61971b495a75a2fbb85c3a3685d76 mbs1/SRPMS/mediawiki-1.22.6-1.mbs1.src.rpm


To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com


Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTa3MXmqjQ0CJFipgRAu+LAJ41wdyfhpLDje3r6vmrZDMAU9adhgCglgT3 praVkE5/9aVQ94iAVTfJso4= =6R+/ -----END PGP SIGNATURE-----