ALT-PU-2015-1194

Критический

ALT-PU-2015-1194: package mediawiki update to version 1.23.8-alt2

Источник

errata.altlinux.org

Дата публикации

21.02.2015

Дата обновления

21.02.2015

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades mediawiki to version 1.23.8-alt2.

Устраненные уязвимости8

CVE-2014-9475

Низкий 3.5

Дата публикации: 16.01.2015

CWE-79

Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.

CVSS 2.0

Низкий 3.5

AV:N/AC:M/Au:S/C:N/I:P/A:N

Access vector: Network
Complexity: Medium
Authentication: Single
Confidentiality: None
Integrity: Partial
Availability: None

Ссылки

CVE-2014-9475 https://nvd.nist.gov/vuln/detail/CVE-2014-9475

Ссылки1

ALT-PU-2015-1194 https://errata.altlinux.org/ALT-PU-2015-1194

Связанные уязвимости

CVE-2014-9475

ubuntu

почти 12 лет назад

CVE-2014-9475

nvd

почти 12 лет назад

CVE-2014-9475

debian

почти 12 лет назад

Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki bef ...

GHSA-68mq-r5mx-h5r5

github

больше 4 лет назад

CVE-2014-9476

ubuntu

почти 12 лет назад

MediaWiki 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote attackers to bypass CORS restrictions in $wgCrossSiteAJAXdomains via a domain that has a partial match to an allowed origin, as demonstrated by "http://en.wikipedia.org.evilsite.example/."