Tim Starling | 15 Dec 12:09 2008

MediaWiki 1.13.3, 1.12.2, 1.6.11 security update

This is a security release of MediaWiki 1.13.3, 1.12.1 and 1.6.11.
Some of the security issues affect *all* versions of MediaWiki except
the versions released today, so all site administrators are encouraged
to upgrade.

Users of the development (trunk) branch should upgrade to r44506 or later.

David Remahl of Apple's Product Security team has identified a number
of security issues in MediaWiki. Subsequent analysis by the MediaWiki
development team led to further discoveries. The issues with a
significant impact are as follows:

* An XSS vulnerability affecting all MediaWiki installations between
1.13.0 and 1.13.2. [CVE-2008-5249]
* A local script injection vulnerability affecting Internet Explorer
clients for all MediaWiki installations with uploads enabled.
* A local script injection vulnerability affecting clients with SVG
scripting capability (such as Firefox 1.5+), for all MediaWiki
installations with SVG uploads enabled. [CVE-2008-5250]
* A CSRF vulnerability affecting the Special:Import feature, for all
MediaWiki installations since the feature was introduced in 1.3.0.

These four vulnerabilities are all fixed in these releases.

XSS (cross-site scripting) vulnerabilities allow an attacker to steal
an authorised user's login session, and to act as that user on the
wiki. The authorised user must visit a web page controlled by the
(Continue reading)