Date: Thu, 24 Dec 2015 13:54:41 +0000 (UTC) From: Jason Unovitch <junovitch@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r404359 - head/security/vuxml Message-ID: <201512241354.tBODsfqL075620@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: junovitch Date: Thu Dec 24 13:54:41 2015 New Revision: 404359 URL: https://svnweb.freebsd.org/changeset/ports/404359 Log: Document recent MediaWiki vulnerabilities Security: CVE-2015-8628 Security: CVE-2015-8627 Security: CVE-2015-8626 Security: CVE-2015-8625 Security: CVE-2015-8624 Security: CVE-2015-8623 Security: CVE-2015-8622 Security: https://vuxml.FreeBSD.org/freebsd/f36bbd66-aa44-11e5-8f5c-002590263bf5.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Dec 24 13:31:53 2015 (r404358) +++ head/security/vuxml/vuln.xml Thu Dec 24 13:54:41 2015 (r404359) @@ -58,6 +58,72 @@ Notes: --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="f36bbd66-aa44-11e5-8f5c-002590263bf5"> + <topic>mediawiki -- multiple vulnerabilities</topic> + <affects> + <package> + <name>mediawiki123</name> + <range><lt>1.23.12</lt></range> + </package> + <package> + <name>mediawiki124</name> + <range><lt>1.24.5</lt></range> + </package> + <package> + <name>mediawiki125</name> + <range><lt>1.25.4</lt></range> + </package> + <package> + <name>mediawiki126</name> + <range><lt>1.26.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>MediaWiki reports:</p> + <blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html">; + <p>(T117899) SECURITY: $wgArticlePath can no longer be set to relative + paths that do not begin with a slash. This enabled trivial XSS + attacks. Configuration values such as "http://my.wiki.com/wiki/$1" + are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is + not and will now throw an error.</p> + <p>(T119309) SECURITY: Use hash_compare() for edit token comparison. + </p> + <p>(T118032) SECURITY: Don't allow cURL to interpret POST parameters + starting with '@' as file uploads.</p> + <p>(T115522) SECURITY: Passwords generated by User::randomPassword() + can no longer be shorter than $wgMinimalPasswordLength.</p> + <p>(T97897) SECURITY: Improve IP parsing and trimming. Previous + behavior could result in improper blocks being issued.</p> + <p>(T109724) SECURITY: Special:MyPage, Special:MyTalk, + Special:MyContributions and related pages no longer use HTTP + redirects and are now redirected by MediaWiki.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2015-8622</cvename> + <cvename>CVE-2015-8623</cvename> + <cvename>CVE-2015-8624</cvename> + <cvename>CVE-2015-8625</cvename> + <cvename>CVE-2015-8626</cvename> + <cvename>CVE-2015-8627</cvename> + <cvename>CVE-2015-8628</cvename> + <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html</url>; + <url>https://phabricator.wikimedia.org/T117899</url>; + <url>https://phabricator.wikimedia.org/T119309</url>; + <url>https://phabricator.wikimedia.org/T118032</url>; + <url>https://phabricator.wikimedia.org/T115522</url>; + <url>https://phabricator.wikimedia.org/T97897</url>; + <url>https://phabricator.wikimedia.org/T109724</url>; + <url>http://www.openwall.com/lists/oss-security/2015/12/23/7</url>; + </references> + <dates> + <discovery>2015-12-18</discovery> + <entry>2015-12-24</entry> + </dates> + </vuln> + <vuln vid="3b50881d-1860-4721-aab1-503290e23f6c"> <topic>Ruby -- unsafe tainted string vulnerability</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201512241354.tBODsfqL075620>