ALT-PU-2014-1286

Низкий

ALT-PU-2014-1286: package mediawiki update to version 1.22.4-alt1

Источник

errata.altlinux.org

Дата публикации

14.03.2014

Дата обновления

14.03.2014

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades mediawiki to version 1.22.4-alt1.

Устраненные уязвимости3

CVE-2014-2242

Средний 4.3

Дата публикации: 02.03.2014

CWE-79

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.

CVSS 2.0

Средний 4.3

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access vector: Network
Complexity: Medium
Authentication: None
Confidentiality: None
Integrity: Partial
Availability: None

Ссылки

CVE-2014-2242 https://nvd.nist.gov/vuln/detail/CVE-2014-2242

Ссылки1

ALT-PU-2014-1286 https://errata.altlinux.org/ALT-PU-2014-1286

Связанные уязвимости

CVE-2014-2242

ubuntu

больше 12 лет назад

CVE-2014-2242

nvd

больше 12 лет назад

CVE-2014-2242

debian

больше 12 лет назад

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and ...

GHSA-xvhv-fm6p-g8q4

github

больше 4 лет назад

CVE-2014-2244

ubuntu

больше 12 лет назад

Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.