This is a multi-part message in MIME format...

------------=_1418565969-5600-2

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:241
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : mediawiki
 Date    : December 14, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated mediawiki packages fix security vulnerabilies:
 
 In MediaWiki before 1.23.7, a missing CSRF check could allow reflected
 XSS on wikis that allow raw HTML (CVE-2014-9276).
 
 MediaWiki's  mangling, in MediaWiki before 1.23.7, could
 allow an article editor to inject code into API consumers that
 blindly unserialize PHP representations of the page from the API
 (CVE-2014-9277).
 
 This update provides MediaWiki 1.23.7, which fixes these security
 issues and other bugs.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9276
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9277
 http://advisories.mageia.org/MGASA-2014-0506.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 0f5bdc4a242be8ca06a40a312b32c7ef 
 mbs1/x86_64/mediawiki-1.23.7-1.mbs1.noarch.rpm
 0f47f57785c1aba4ebc8f2eee8357624 
 mbs1/x86_64/mediawiki-mysql-1.23.7-1.mbs1.noarch.rpm
 365f69a5faf3ef56514cdce61d7447d9 
 mbs1/x86_64/mediawiki-pgsql-1.23.7-1.mbs1.noarch.rpm
 cba281c689c5fea48729824c846f7b97 
 mbs1/x86_64/mediawiki-sqlite-1.23.7-1.mbs1.noarch.rpm 
 a4030cd00410b812d48db327ebc165a6  mbs1/SRPMS/mediawiki-1.23.7-1.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUjYsLmqjQ0CJFipgRAkSfAJsEny/nKnGjKgFGK87yZZAOQFPmvACgoY8S
pE8nHuaehD94b8n0wF7MpBI=
=02r3
-----END PGP SIGNATURE-----


------------=_1418565969-5600-2
Content-Type: text/plain; charset="UTF-8";
 name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
_______________________________________________________


------------=_1418565969-5600-2--