SB2015020704 - Gentoo update for MediaWiki
Published: February 7, 2015 Updated: September 25, 2016
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 27 secuirty vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2013-6451)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Cross-site scripting (CVE-ID: CVE-2013-6452)
Vulnerability allows a remote attacker to perform Cross-site scripting attacks.
An input validation error exists in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) Input validation error (CVE-ID: CVE-2013-6453)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.
4) Cross-site scripting (CVE-ID: CVE-2013-6454)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
5) Information disclosure (CVE-ID: CVE-2013-6472)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via the (1) log API, (2) enhanced RecentChanges, and (3) user watchlists.
6) Input validation error (CVE-ID: CVE-2014-1610)
The vulnerability allows a remote #AU# to read and manipulate data.
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
7) Cross-site scripting (CVE-ID: CVE-2014-2242)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. The vulnerability allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
8) Race condition (CVE-ID: CVE-2014-2243)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.
9) Cross-site scripting (CVE-ID: CVE-2014-2244)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
10) Cross-site request forgery (CVE-ID: CVE-2014-2665)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
11) Cross-site scripting (CVE-ID: CVE-2014-2853)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 when processing sort key in an info action. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
12) Cross-site request forgery (CVE-ID: CVE-2014-5241)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
13) Cross-site scripting (CVE-ID: CVE-2014-5242)
Vulnerability allows a remote attacker to perform Cross-site scripting attacks.
An input validation error exists in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
14) Input validation error (CVE-ID: CVE-2014-5243)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
15) Cross-site scripting (CVE-ID: CVE-2014-7199)
Vulnerability allows a remote attacker to perform Cross-site scripting attacks.
An input validation error exists in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
16) Cross-site scripting (CVE-ID: CVE-2014-7295)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via "The (1) Special:Preferences and (2) Special:UserLogin pages" when modifying MediaWiki:Common.css. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website .
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
17) Cross-site scripting (CVE-ID: CVE-2014-9276)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. The vulnerability allows remote attackers to hijack the authentication of users with edit permissions for requests that cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly handled in the preview.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
18) Command Injection (CVE-ID: CVE-2014-9277)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.
19) Cross-site scripting (CVE-ID: CVE-2014-9475)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
20) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-9476)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.evilsite.example/."
21) Cross-site scripting (CVE-ID: CVE-2014-9477)
Vulnerability allows a remote attacker to perform Cross-site scripting attacks.
An input validation error exists in the Listings extension for MediaWiki when processing the (1) name or (2) url parameter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
22) Cross-site scripting (CVE-ID: CVE-2014-9478)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true,. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
23) Cross-site scripting (CVE-ID: CVE-2014-9479)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in the preview in the TemplateSandbox extension for MediaWiki when processing text parameter to Special:TemplateSandbox. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
24) Cross-site scripting (CVE-ID: CVE-2014-9480)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in the Hovercards extension for MediaWiki. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
25) Information disclosure (CVE-ID: CVE-2014-9481)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
26) Input validation error (CVE-ID: CVE-2014-9487)
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
27) Cross-site scripting (CVE-ID: CVE-2014-9507)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. The vulnerability allows remote attackers to conduct cross-site scripting (XSS) attacks by setting the content model for a revision to JS.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.