Bug 1293847 (CVE-2015-8622, CVE-2015-8623, CVE-2015-8624, CVE-2015-8625, CVE-2015-8626, CVE-2015-8627, CVE-2015-8628)

Several flaws were found in Mediawiki:

* (T117899) XSS from wikitext when $wgArticlePath='$1'. Internal review
discovered an XSS vector when MediaWiki is configured with a non-standard
configuration.
<https://phabricator.wikimedia.org/T117899>

* (T119309) User::matchEditToken should use constant-time string
comparison. Internal review discovered that tokens were being compared as
strings, which could allow a timing attack. This should possibly have 2
CVE's assigned, one for the original patch to use hash_equals in
https://gerrit.wikimedia.org/r/#/c/156336/5/includes/User.php (released as
part of MediaWiki 1.25, and backported to 1.24 and 1.23 as part of this
patch) and one to fix T119309, related to the debugging statement.
<https://phabricator.wikimedia.org/T119309>

* (T118032) Error thrown by VirtualRESTService when POST variable starts
with '@'. Internal review discovered that MediaWiki was not sanitizing
parameters passed to the curl library, which could cause curl to upload
files from the webserver to an attacker.
<https://phabricator.wikimedia.org/T118032>

* (T115522) Passwords generated by User::randomPassword() may be shorter
than $wgMinimalPasswordLength. MediaWiki user Frank R. Farmer reported that
the password reset token could be shorter than the minimum required
password length.
<https://phabricator.wikimedia.org/T115522>

* (T97897) Incorrect parsing of IPs for global block. Wikimedia steward
Vituzzu reported that blocking IP addresses with zero-padded octets
resulted in a failure to block the IP address.
<https://phabricator.wikimedia.org/T97897>

* (T109724) A combination of Special:MyPage redirects and pagecounts allows
an external site to know the wikipedia login of an user. Wikimedia
user Xavier Combelle reported a way to identify user, when detailed page
view data is also released.
<https://phabricator.wikimedia.org/T109724>

CVE request and original report:

http://openwall.com/lists/oss-security/2015/12/21/8