drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in MediaWiki
Name: |
Zwei Probleme in MediaWiki |
|
ID: |
MDVSA-2014:083 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Mandriva Business Server 1.0 |
|
Datum: |
Do, 8. Mai 2014, 20:44 |
|
Referenzen: |
http://advisories.mageia.org/MGASA-2014-0157.html
http://advisories.mageia.org/MGASA-2014-0197.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2665 |
|
Applikationen: |
MediaWiki |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1399561569-13181-3
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2014:083 http://www.mandriva.com/en/support/security/ _______________________________________________________________________
Package : mediawiki Date : May 8, 2014 Affected: Business Server 1.0 _______________________________________________________________________
Problem Description:
Updated mediawiki packages fix security vulnerabilities: Login CSRF issue in MediaWiki before 1.22.5 in Special:ChangePassword, whereby a user can be logged into an attackers account without being aware of it, allowing the attacker to track the user's activity (CVE-2014-2665). XSS vulnerability in MediaWiki before 1.22.6, where if the default sort key is set to a string containing a script, the script will be executed when the page is viewed using the info action. MediaWiki has been updated to version 1.22.6, fixing this and other issues. _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2665 http://advisories.mageia.org/MGASA-2014-0157.html http://advisories.mageia.org/MGASA-2014-0197.html _______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64: 292fb98c951c1b2111ad9fe0bb26a6d2 mbs1/x86_64/mediawiki-1.22.6-1.mbs1.noarch.rpm 7b12b37abd00c4f4e9cf3987d1305ffb mbs1/x86_64/mediawiki-mysql-1.22.6-1.mbs1.noarch.rpm 2d7eb5e3fba48833afa4ab7c6d7c7f52 mbs1/x86_64/mediawiki-pgsql-1.22.6-1.mbs1.noarch.rpm 854f21c25837fbabf6e44353606e5ba3 mbs1/x86_64/mediawiki-sqlite-1.22.6-1.mbs1.noarch.rpm 16c61971b495a75a2fbb85c3a3685d76 mbs1/SRPMS/mediawiki-1.22.6-1.mbs1.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFTa3MXmqjQ0CJFipgRAu+LAJ41wdyfhpLDje3r6vmrZDMAU9adhgCglgT3 praVkE5/9aVQ94iAVTfJso4= =6R+/ -----END PGP SIGNATURE-----
------------=_1399561569-13181-3 Content-Type: text/plain; charset="UTF-8"; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://store.mandriva.com _______________________________________________________
------------=_1399561569-13181-3--
|
|
|
|