Fedora alert FEDORA-2015-5570 (mediawiki)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 21 Update: mediawiki-1.24.2-1.fc21 | |
| Date: | Sat, 18 Apr 2015 09:53:44 +0000 | |
| Message-ID: | <20150418095345.67340604C8AD@bastion01.phx2.fedoraproject.org> |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-5570 2015-04-05 11:02:52 -------------------------------------------------------------------------------- Name : mediawiki Product : Fedora 21 Version : 1.24.2 Release : 1.fc21 URL : http://www.mediawiki.org/ Summary : A wiki engine Description : MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances under /usr/share/doc/mediawiki/README.RPM. Remember to remove the config dir after completing the configuration. -------------------------------------------------------------------------------- Update Information: Changes since 1.24.1 * (bug T85848, bug T71210) SECURITY: Don't parse XMP blocks that contain XML entities, to prevent various DoS attacks. * (bug T85848) SECURITY: Don't allow directly calling Xml::isWellFormed, to reduce likelihood of DoS. * (bug T88310) SECURITY: Always expand xml entities when checking SVG's. * (bug T73394) SECURITY: Escape > in Html::expandAttributes to prevent XSS. * (bug T85855) SECURITY: Don't execute another user's CSS or JS on preview. * (bug T64685) SECURITY: Allow setting maximal password length to prevent DoS when using PBKDF2. * (bug T85349, bug T85850, bug T86711) SECURITY: Multiple issues fixed in SVG filtering to prevent XSS and protect viewer's privacy. * Fix case of SpecialAllPages/SpecialAllMessages in SpecialPageFactory to fix loading these special pages when $wgAutoloadAttemptLowercase is false. * (bug T70087) Fix Special:ActiveUsers page for installations using PostgreSQL. * (bug T76254) Fix deleting of pages with PostgreSQL. Requires a schema change and running update.php to fix. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 1 2015 Michael Cronenworth <mike@cchtml.com> - 1.24.2-1 - Update to 1.24.2 - (bug T85848, bug T71210) SECURITY: Don't parse XMP blocks that contain XML entities, to prevent various DoS attacks. - (bug T85848) SECURITY: Don't allow directly calling Xml::isWellFormed, to reduce likelihood of DoS. - (bug T88310) SECURITY: Always expand xml entities when checking SVG's. - (bug T73394) SECURITY: Escape > in Html::expandAttributes to prevent XSS. - (bug T85855) SECURITY: Don't execute another user's CSS or JS on preview. - (bug T64685) SECURITY: Allow setting maximal password length to prevent DoS when using PBKDF2. - (bug T85349, bug T85850, bug T86711) SECURITY: Multiple issues fixed in SVG filtering to prevent XSS and protect viewer's privacy. - Fix case of SpecialAllPages/SpecialAllMessages in SpecialPageFactory to fix loading these special pages when $wgAutoloadAttemptLowercase is false. - (bug T70087) Fix Special:ActiveUsers page for installations using PostgreSQL. - (bug T76254) Fix deleting of pages with PostgreSQL. Requires a schema change and running update.php to fix. * Thu Dec 18 2014 Michael Cronenworth <mike@cchtml.com> - 1.24.1-1 - Update to 1.24.1 - (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which could lead to xss. Permission to edit MediaWiki namespace is required to exploit this. - (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as part of its name. - (bug T74222) The original patch for T74222 was reverted as unnecessary. - Fixed a couple of entries in RELEASE-NOTES-1.24. - (bug T76168) OutputPage: Add accessors for some protected properties. - (bug T74834) Make 1.24 branch directly installable under PostgreSQL. * Fri Nov 28 2014 Michael Cronenworth <mike@cchtml.com> - 1.24.0-1 - Update to 1.24.0 - Release notes: http://www.mediawiki.org/wiki/Release_notes/1.24 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1208072 - mediawiki: mediawiki: security issues fixed in the 1.24.2, 1.23.9, and 1.19.24 releases https://bugzilla.redhat.com/show_bug.cgi?id=1208072 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update mediawiki' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...