Bug 1253280 (CVE-2013-7444, CVE-2015-6727, CVE-2015-6728, CVE-2015-6729, CVE-2015-6730, CVE-2015-6731, CVE-2015-6732, CVE-2015-6733, CVE-2015-6734, CVE-2015-6735, CVE-2015-6736, CVE-2015-6737)

Summary: CVE-2013-7444 CVE-2015-6737 CVE-2015-6736 CVE-2015-6727 CVE-2015-6733 CVE-2015-6732 CVE-2015-6731 CVE-2015-6730 CVE-2015-6728 CVE-2015-6729 CVE-2015-6735 CVE-2015-6734 mediawiki: multiple security fixes in 1.25.2, 1.24.3, 1.23.10
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED RAWHIDE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: extras-orphan, gwync, mike, puiterwijk
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: MediaWiki 1.25.2, MediaWiki 1.24.3, MediaWiki 1.23.10 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-12-14 17:19:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1253281    
Bug Blocks:    

Description Vasyl Kaigorodov 2015-08-13 12:04:08 UTC 
Following security issues were fixed in MediaWiki 1.25.2, MediaWiki 1.24.3, MediaWiki 1.23.10:

* Internal review discovered that Special:DeletedContributions did not
properly protect the IP of autoblocked users. This fix makes the
functionality of Special:DeletedContributions consistent with
Special:Contributions and Special:BlockList.
<https://phabricator.wikimedia.org/T106893>

* Internal review discovered that watchlist anti-csrf tokens were not being
compared in constant time, which could allow various timing attacks. This
could allow an attacker to modify a user's watchlist via csrf.
<https://phabricator.wikimedia.org/T94116>

* John Menerick reported that MediaWiki's thumb.php failed to sanitize
various error messages, resulting in xss.
<https://phabricator.wikimedia.org/T97391>

* Extension:SemanticForms - MediaWiki user Grunny discovered multiple
reflected xss vectors in SemanticForms. Further internal review discovered
and fixed other reflected and stored xss vectors.
<https://phabricator.wikimedia.org/T103391>
<https://phabricator.wikimedia.org/T103765>
<https://phabricator.wikimedia.org/T103761>

* Extension:SyntaxHighlight_GeSHi - xss and potential DoS vectors. Internal
review discovered that the contib directory for GeSHi was re-included in
MediaWiki 1.25. Some scripts could be potentially be used for DoS, and DAU
Huy Ngoc discovered an xss vector. All contrib scripts have been removed.
<https://phabricator.wikimedia.org/T108198>

* Extension:TimedMediaHandler - User:McZusatz reported that resetting
transcodes deleted the transcode without creating a new one, which could be
used for vandalism or potentially DoS.
<https://phabricator.wikimedia.org/T100211>

* Extension:Quiz - Internal review discovered that Quiz did not properly
escape regex metacharacters in a user controlled regular expression,
enabling a DoS vector.
<https://phabricator.wikimedia.org/T97083>

* Extension:Widgets - MediaWiki developer Majr reported a potential HTML
injection (xss) vector.
<https://phabricator.wikimedia.org/T88964>

CVE request: http://seclists.org/oss-sec/2015/q3/332
Comment 1 Fedora Update System 2015-08-21 14:52:17 UTC 
mediawiki-1.25.2-2.fc23 has been submitted as an update to Fedora 23. https://bugzilla.redhat.com/show_bug.cgi?id=1253280
Comment 2 Fedora Update System 2015-08-22 02:51:59 UTC 
mediawiki-1.25.2-2.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update mediawiki'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/mediawiki-1.25.2-2.fc22
Comment 3 Fedora Update System 2015-08-22 04:19:36 UTC 
mediawiki-1.24.3-1.fc21 has been pushed to the Fedora 21 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update mediawiki'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/mediawiki-1.24.3-1.fc21
Comment 4 Fedora Update System 2015-08-22 16:24:35 UTC 
mediawiki-1.25.2-2.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update mediawiki'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-13920
Comment 5 Martin Prpič 2015-08-28 10:26:16 UTC 
CVE assignment:

http://seclists.org/oss-sec/2015/q3/449
Comment 6 Fedora Update System 2015-08-28 17:36:11 UTC 
mediawiki-1.25.2-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2015-09-03 18:49:44 UTC 
mediawiki-1.24.3-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2015-09-03 18:50:21 UTC 
mediawiki-1.25.2-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.