Debian alert DSA-6380-1 (mediawiki)

From:
             
 
Moritz Muehlenhoff <jmm@debian.org>
To:
             
 
debian-security-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DSA 6380-1] mediawiki security update
Date:
             
 
Sun, 05 Jul 2026 18:56:30 +0000
Message-ID:
             
 
<akqo3pRPbP6RivgM@seger.debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6380-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
July 05, 2026                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : mediawiki
CVE ID         : CVE-2026-58024 CVE-2026-58025 CVE-2026-58026 CVE-2026-58027 
                 CVE-2026-58028 CVE-2026-58029 CVE-2026-58030 CVE-2026-58032 
                 CVE-2026-58033 CVE-2026-58037

Multiple security issues were discovered in MediaWiki, a website engine
for collaborative work, which could result in information disclosure,
code execution via unsafe deserialisation or cross-site scripting.

For the stable distribution (trixie), these problems have been fixed in
version 1:1.43.9+dfsg-1~deb13u1.

We recommend that you upgrade your mediawiki packages.

For the detailed security status of mediawiki please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mediawiki

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmpKqKoACgkQEMKTtsN8
TjZyjA//WD+/BDzcOfJglDb9LlPcjZpgMabFnRvaySD8K8hK5QAGhpOKJzFN+Z/s
62NY4pzGUc8/WG/Vqv+Kbl2jCOBh5nHOZJN+Y8YgbH0ihYwu7rmft5ElsdmaPCzT
19rfYa1BeceWoBem6Wrh82dAwh+lujlNhYK0G1i6OVnbm9QyQ5a5/mfNFDp6I8TF
Pbj+muWFMZlt+pQ3cessz7/8kxvYen9XSYYlbH/pWfqcmuGqTi1brs3jFtyP2J27
4PpqGoWmwkRfm9ZuDVmeV1MABuh+wtuD7k4TqxMB6/Mb4sx/RIuFxXidXxdCyh2b
lU+/lr1MPnS3dZG/CWlNHHELc2+rLCQSyNSeKzhU1nrrpqNLhVKUD2n/MMolTEre
Hh+Lxk4k+LnqBj2iJz3C1JJ1bsIGEo5fDeni8E6N0ToJqguVg/AnnXd0bYwslaW3
Q/tZ1ZFonb6t9Pbp3NRo2m099u7+7/D6/2UObYKd+Lt9ZVWVWGIBo3YZcmnELI1n
9YLP8qrb67gsKqQnLRspMvaxccLR/JLQ4UshxwTzbVneDkAE/bbkTYfjUec/Ai1N
9ArudNVKc89KmtlYn0ZBwff5GrEq9VBe/62HUMs/V1C61gkj7xRNoje86uJGb9rU
hKcu2ULntQK36mSJRFsySW5cduHoZXWxG7M9z1xkjycVKLXEScQ=
=VHpo
-----END PGP SIGNATURE-----