Date: Fri, 14 Aug 2015 17:09:29 +0000 (UTC) From: Jason Unovitch <junovitch@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r394240 - head/security/vuxml Message-ID: <201508141709.t7EH9Tsn050563@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: junovitch Date: Fri Aug 14 17:09:29 2015 New Revision: 394240 URL: https://svnweb.freebsd.org/changeset/ports/394240 Log: Document MediaWiki multiple security vulnerabilities PR: 202328 Security: 6241b5df-42a1-11e5-93ad-002590263bf5 Approved by: feld (mentor) Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Aug 14 17:06:48 2015 (r394239) +++ head/security/vuxml/vuln.xml Fri Aug 14 17:09:29 2015 (r394240) @@ -58,6 +58,51 @@ Notes: --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="6241b5df-42a1-11e5-93ad-002590263bf5"> + <topic>mediawiki -- multiple vulnerabilities</topic> + <affects> + <package> + <name>mediawiki123</name> + <range><lt>1.23.10</lt></range> + </package> + <package> + <name>mediawiki124</name> + <range><lt>1.24.3</lt></range> + </package> + <package> + <name>mediawiki125</name> + <range><lt>1.25.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>MediaWiki reports:</p> + <blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html">; + <p>Internal review discovered that Special:DeletedContributions did + not properly protect the IP of autoblocked users. This fix makes + the functionality of Special:DeletedContributions consistent with + Special:Contributions and Special:BlockList.</p> + <p>Internal review discovered that watchlist anti-csrf tokens were not + being compared in constant time, which could allow various timing + attacks. This could allow an attacker to modify a user's watchlist + via csrf</p> + <p>John Menerick reported that MediaWiki's thumb.php failed to sanitize + various error messages, resulting in xss.</p> + </blockquote> + </body> + </description> + <references> + <url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html</url>; + <url>https://phabricator.wikimedia.org/T106893</url>; + <url>https://phabricator.wikimedia.org/T94116</url>; + <url>https://phabricator.wikimedia.org/T97391</url>; + </references> + <dates> + <discovery>2015-08-10</discovery> + <entry>2015-08-14</entry> + </dates> + </vuln> + <vuln vid="0c2c4d84-42a2-11e5-9daa-14dae9d210b8"> <topic>freeradius3 -- insufficient validation on packets</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201508141709.t7EH9Tsn050563>