Bug 1253280 (CVE-2013-7444, CVE-2015-6727, CVE-2015-6728, CVE-2015-6729, CVE-2015-6730, CVE-2015-6731, CVE-2015-6732, CVE-2015-6733, CVE-2015-6734, CVE-2015-6735, CVE-2015-6736, CVE-2015-6737) - CVE-2013-7444 CVE-2015-6737 CVE-2015-6736 CVE-2015-6727 CVE-2015-6733 CVE-2015-6732 CVE-2015-6731 CVE-2015-6730 CVE-2015-6728 CVE-2015-6729 CVE-2015-6735 CVE-2015-6734 mediawiki: multiple security fixes in 1.25.2, 1.24.3, 1.23.10
Summary: CVE-2013-7444 CVE-2015-6737 CVE-2015-6736 CVE-2015-6727 CVE-2015-6733 CVE-201...
Keywords:
Status: CLOSED RAWHIDE
Alias: CVE-2013-7444, CVE-2015-6727, CVE-2015-6728, CVE-2015-6729, CVE-2015-6730, CVE-2015-6731, CVE-2015-6732, CVE-2015-6733, CVE-2015-6734, CVE-2015-6735, CVE-2015-6736, CVE-2015-6737
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1253281
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-08-13 12:04 UTC by Vasyl Kaigorodov
Modified: 2019-09-29 13:36 UTC (History)
4 users (show)

Fixed In Version: MediaWiki 1.25.2, MediaWiki 1.24.3, MediaWiki 1.23.10
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-12-14 17:19:27 UTC
Embargoed:


Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-08-13 12:04:08 UTC
Following security issues were fixed in MediaWiki 1.25.2, MediaWiki 1.24.3, MediaWiki 1.23.10:

* Internal review discovered that Special:DeletedContributions did not
properly protect the IP of autoblocked users. This fix makes the
functionality of Special:DeletedContributions consistent with
Special:Contributions and Special:BlockList.
<https://phabricator.wikimedia.org/T106893>

* Internal review discovered that watchlist anti-csrf tokens were not being
compared in constant time, which could allow various timing attacks. This
could allow an attacker to modify a user's watchlist via csrf.
<https://phabricator.wikimedia.org/T94116>

* John Menerick reported that MediaWiki's thumb.php failed to sanitize
various error messages, resulting in xss.
<https://phabricator.wikimedia.org/T97391>

* Extension:SemanticForms - MediaWiki user Grunny discovered multiple
reflected xss vectors in SemanticForms. Further internal review discovered
and fixed other reflected and stored xss vectors.
<https://phabricator.wikimedia.org/T103391>
<https://phabricator.wikimedia.org/T103765>
<https://phabricator.wikimedia.org/T103761>

* Extension:SyntaxHighlight_GeSHi - xss and potential DoS vectors. Internal
review discovered that the contib directory for GeSHi was re-included in
MediaWiki 1.25. Some scripts could be potentially be used for DoS, and DAU
Huy Ngoc discovered an xss vector. All contrib scripts have been removed.
<https://phabricator.wikimedia.org/T108198>

* Extension:TimedMediaHandler - User:McZusatz reported that resetting
transcodes deleted the transcode without creating a new one, which could be
used for vandalism or potentially DoS.
<https://phabricator.wikimedia.org/T100211>

* Extension:Quiz - Internal review discovered that Quiz did not properly
escape regex metacharacters in a user controlled regular expression,
enabling a DoS vector.
<https://phabricator.wikimedia.org/T97083>

* Extension:Widgets - MediaWiki developer Majr reported a potential HTML
injection (xss) vector.
<https://phabricator.wikimedia.org/T88964>

CVE request: http://seclists.org/oss-sec/2015/q3/332

Comment 1 Fedora Update System 2015-08-21 14:52:17 UTC
mediawiki-1.25.2-2.fc23 has been submitted as an update to Fedora 23. https://bugzilla.redhat.com/show_bug.cgi?id=1253280

Comment 2 Fedora Update System 2015-08-22 02:51:59 UTC
mediawiki-1.25.2-2.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update mediawiki'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/mediawiki-1.25.2-2.fc22

Comment 3 Fedora Update System 2015-08-22 04:19:36 UTC
mediawiki-1.24.3-1.fc21 has been pushed to the Fedora 21 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update mediawiki'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/mediawiki-1.24.3-1.fc21

Comment 4 Fedora Update System 2015-08-22 16:24:35 UTC
mediawiki-1.25.2-2.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update mediawiki'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-13920

Comment 5 Martin Prpič 2015-08-28 10:26:16 UTC
CVE assignment:

http://seclists.org/oss-sec/2015/q3/449

Comment 6 Fedora Update System 2015-08-28 17:36:11 UTC
mediawiki-1.25.2-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2015-09-03 18:49:44 UTC
mediawiki-1.24.3-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2015-09-03 18:50:21 UTC
mediawiki-1.25.2-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.