Chris Steipp | 31 Aug 06:26 2012
Picon

MediaWiki security release: 1.19.2 and 1.18.5

I would like to announce the release of MediaWiki 1.19.2 and 1.18.5.
These releases fix 6 security related bugs that could affect users of
MediaWiki. Download links are given at the end of this email.

* Wikipedia administrator Writ Keeper discovered a stored XSS (HTML
injection) vulnerability. This was possible due to the handling of
link text on File: links for nonexistent files. MediaWiki 1.16 and
later is affected. For more details, see
<https://bugzilla.wikimedia.org/show_bug.cgi?id=39700>

* User Fomafix reported several DOM-based XSS vulnerabilities, made
possible by a combination of loose filtering of the uselang parameter,
and JavaScript gadgets on various language Wikipedias. For more
details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=37587>

* During internal review, it was discovered that CSRF tokens,
available via the api, were not protected with X-Frame-Options
headers. This could lead to a CSRF vulnerability if the API response
is embedded in an external website using an iframe. For more details,
see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39180>

* During internal review, it was discovered extensions were not always
allowed to prevent the account creation action. This allowed users
blocked by the GlobalBlocking extension to create accounts. For more
details, see <https://bugzilla.wikimedia.org/show_bug.cgi?id=39824>

* During internal review, it was discovered that password data was
always saved to the local MediaWiki database, even if authentication
was handled by an extension, such as LDAP. This could allow a
compromised MediaWiki installation to leak information about user's
(Continue reading)


Gmane