headers
Tim Starling | 2 Oct 2008 18:03
Picon

MediaWiki 1.13.2, 1.12.1 security update


This is a security and bugfix release of MediaWiki 1.12 and MediaWiki
1.13. A vulnerability has been discovered which allows arbitrary HTML
injection and thus possible user account compromise. The vulnerability
is only present when $wgUseSiteCss is turned on, which is the
default.  Versions 1.11 and earlier are NOT vulnerable, nor is
development branch later than July 28, 2008.

Also, there was the potential for a subtle user error while editing
$wgGroupPermissions in LocalSettings.php to cause all restrictions to
be disabled. This has been rectified.

Full release notes:
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_2/phase3/RELEASE-NOTES
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_1/phase3/RELEASE-NOTES

See below for downloads.

**********************************************************************
    MEDIAWIKI   1.13.2
**********************************************************************

Download:
http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.2.tar.gz

Patch to previous version (1.13.1), without interface text:
http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.2.patch.gz
Interface text changes:
http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.2.patch.gz
(Continue reading)

Permalink | Reply | 0 comments |
headers
Tim Starling | 2 Oct 2008 19:29
Picon

Version number incorrect in latest releases


The MediaWiki version number, $wgVersion in
includes/DefaultSettings.php, wasn't updated in the release of 1.12.1
and 1.13.2. So these releases will report themselves as being 1.12.0
and 1.13.1 respectively, in [[Special:Version]] and other places. A
new, corrected tarball has been uploaded.

New SHA-1 checksums:
c6f6e404ee9152deeec63cdc3278a2a57d556efe  mediawiki-1.13.2.tar.gz
046206b342904cb729fd076ddd101534e23b6c07  mediawiki-1.13.2.patch.gz
4500cde3e60351ae2fc0382b8e91654f4cb6a0ff  mediawiki-i18n-1.13.2.patch.gz

6f315f88a481daa1a92b1a409e92e036aaca610b  mediawiki-1.12.1.tar.gz
1aed1e8083ebe98e884c924dad174c2fb1537d8b  mediawiki-1.12.1.patch.gz
71fb3d06c1fe331fecf25cca92ea50bb07ce7465  mediawiki-i18n-1.12.1.patch.gz

New MD5 checksums:
e10f791ba9ecd02dd751a5676cc84405  mediawiki-1.13.2.tar.gz
2e33ed21c5e889f546556066a2b53806  mediawiki-1.13.2.patch.gz
db1e3b46e04a2608ea5429d73465ad03  mediawiki-i18n-1.13.2.patch.gz

00229272c5e1881ff36a07ca95891ca2  mediawiki-1.12.1.tar.gz
885c6dc5bce177563c3d7a14e5167411  mediawiki-1.12.1.patch.gz
82f874b72a65e71e41f4dadf410e0eec  mediawiki-i18n-1.12.1.patch.gz

-- Tim Starling
Permalink | Reply | 0 comments |
headers
Tim Starling | 2 Oct 2008 18:03
Picon

MediaWiki 1.13.2, 1.12.1 security update


This is a security and bugfix release of MediaWiki 1.12 and MediaWiki
1.13. A vulnerability has been discovered which allows arbitrary HTML
injection and thus possible user account compromise. The vulnerability
is only present when $wgUseSiteCss is turned on, which is the
default.  Versions 1.11 and earlier are NOT vulnerable, nor is
development branch later than July 28, 2008.

Also, there was the potential for a subtle user error while editing
$wgGroupPermissions in LocalSettings.php to cause all restrictions to
be disabled. This has been rectified.

Full release notes:
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_2/phase3/RELEASE-NOTES
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_1/phase3/RELEASE-NOTES

See below for downloads.

**********************************************************************
    MEDIAWIKI   1.13.2
**********************************************************************

Download:
http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.2.tar.gz

Patch to previous version (1.13.1), without interface text:
http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.2.patch.gz
Interface text changes:
http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.2.patch.gz
(Continue reading)

Permalink | Reply | 0 comments |

Gmane