4 Dec 2005 12:31
MediaWiki 1.5.3 released [SECURITY]
Brion Vibber <brion <at> pobox.com>
2005-12-04 11:31:59 GMT
2005-12-04 11:31:59 GMT
MediaWiki 1.5.3 is a security and bugfix maintenance release. Validation of the user language option was broken by a code change in May 2005, opening the possibility of remote code execution as this parameter is used in forming a class name dynamically created with eval(). The validation has been corrected in this version. All prior 1.5 release and prerelease versions are affected; 1.4 and earlier and not affected. Additionally several bugs have been fixed; see the changelog in the release notes for a complete list. Release notes: http://sourceforge.net/project/shownotes.php?release_id=375755 Download: http://prdownloads.sourceforge.net/wikipedia/mediawiki-1.5.3.tar.gz?download MD5 checksum: fc697787f04208d1842a2c646deca626 mediawiki-1.5.3.tar.gz SHA-1 checksum: 070189e29ace2ef9ab0589db42ecf849f2b88ee5 mediawiki-1.5.3.tar.gz Before asking for help, try the FAQ: http://meta.wikimedia.org/wiki/MediaWiki_FAQ Low-traffic release announcements mailing list:(Continue reading)
RSS Feed