Bug 1253280 - (CVE-2013-7444, CVE-2015-6727, CVE-2015-6728, CVE-2015-6729, CVE-2015-6730, CVE-2015-6731, CVE-2015-6732, CVE-2015-6733, CVE-2015-6734, CVE-2015-6735, CVE-2015-6736, CVE-2015-6737) CVE-2013-7444 CVE-2015-6737 CVE-2015-6736 CVE-2015-6727 CVE-2015-6733 CVE-2015-6732 CVE-2015-6731 CVE-2015-6730 CVE-2015-6728 CVE-2015-6729 CVE-2015-6735 CVE-2015-6734 mediawiki: multiple security fixes in 1.25.2, 1.24.3, 1.23.10
CVE-2013-7444 CVE-2015-6737 CVE-2015-6736 CVE-2015-6727 CVE-2015-6733 CVE-201...
Status: CLOSED RAWHIDE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20150812,repor...
: Security
Depends On: 1253281
Blocks:
  Show dependency treegraph
 
Reported: 2015-08-13 08:04 EDT by Vasyl Kaigorodov
Modified: 2016-12-14 12:19 EST (History)
4 users (show)

See Also:
Fixed In Version: MediaWiki 1.25.2, MediaWiki 1.24.3, MediaWiki 1.23.10
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-12-14 12:19:27 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vasyl Kaigorodov 2015-08-13 08:04:08 EDT
Following security issues were fixed in MediaWiki 1.25.2, MediaWiki 1.24.3, MediaWiki 1.23.10:

* Internal review discovered that Special:DeletedContributions did not
properly protect the IP of autoblocked users. This fix makes the
functionality of Special:DeletedContributions consistent with
Special:Contributions and Special:BlockList.
<https://phabricator.wikimedia.org/T106893>

* Internal review discovered that watchlist anti-csrf tokens were not being
compared in constant time, which could allow various timing attacks. This
could allow an attacker to modify a user's watchlist via csrf.
<https://phabricator.wikimedia.org/T94116>

* John Menerick reported that MediaWiki's thumb.php failed to sanitize
various error messages, resulting in xss.
<https://phabricator.wikimedia.org/T97391>

* Extension:SemanticForms - MediaWiki user Grunny discovered multiple
reflected xss vectors in SemanticForms. Further internal review discovered
and fixed other reflected and stored xss vectors.
<https://phabricator.wikimedia.org/T103391>
<https://phabricator.wikimedia.org/T103765>
<https://phabricator.wikimedia.org/T103761>

* Extension:SyntaxHighlight_GeSHi - xss and potential DoS vectors. Internal
review discovered that the contib directory for GeSHi was re-included in
MediaWiki 1.25. Some scripts could be potentially be used for DoS, and DAU
Huy Ngoc discovered an xss vector. All contrib scripts have been removed.
<https://phabricator.wikimedia.org/T108198>

* Extension:TimedMediaHandler - User:McZusatz reported that resetting
transcodes deleted the transcode without creating a new one, which could be
used for vandalism or potentially DoS.
<https://phabricator.wikimedia.org/T100211>

* Extension:Quiz - Internal review discovered that Quiz did not properly
escape regex metacharacters in a user controlled regular expression,
enabling a DoS vector.
<https://phabricator.wikimedia.org/T97083>

* Extension:Widgets - MediaWiki developer Majr reported a potential HTML
injection (xss) vector.
<https://phabricator.wikimedia.org/T88964>

CVE request: http://seclists.org/oss-sec/2015/q3/332
Comment 1 Fedora Update System 2015-08-21 10:52:17 EDT
mediawiki-1.25.2-2.fc23 has been submitted as an update to Fedora 23. https://bugzilla.redhat.com/show_bug.cgi?id=1253280
Comment 2 Fedora Update System 2015-08-21 22:51:59 EDT
mediawiki-1.25.2-2.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update mediawiki'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/mediawiki-1.25.2-2.fc22
Comment 3 Fedora Update System 2015-08-22 00:19:36 EDT
mediawiki-1.24.3-1.fc21 has been pushed to the Fedora 21 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update mediawiki'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/mediawiki-1.24.3-1.fc21
Comment 4 Fedora Update System 2015-08-22 12:24:35 EDT
mediawiki-1.25.2-2.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update mediawiki'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-13920
Comment 5 Martin Prpič 2015-08-28 06:26:16 EDT
CVE assignment:

http://seclists.org/oss-sec/2015/q3/449
Comment 6 Fedora Update System 2015-08-28 13:36:11 EDT
mediawiki-1.25.2-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2015-09-03 14:49:44 EDT
mediawiki-1.24.3-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2015-09-03 14:50:21 EDT
mediawiki-1.25.2-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.