-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA384 Format: 1.8 Date: Mon, 10 Feb 2014 13:07:38 +0100 Source: mediawiki Binary: mediawiki Architecture: source all Version: 1:1.19.11+dfsg-0+deb7u1 Distribution: wheezy-security Urgency: high Maintainer: Mediawiki Maintenance Team <pkg-mediawiki-devel@lists.alioth.debian.org> Changed-By: Thorsten Glaser <tg@mirbsd.de> Description: mediawiki - website engine for collaborative work Closes: 706601 716884 719208 729629 Changes: mediawiki (1:1.19.11+dfsg-0+deb7u1) wheezy-security; urgency=high . [ Thorsten Glaser ] * New upstream security fix release (Closes: #729629, #706601): - CVE-2014-1610 (bug 60339) remote code exec in Djvu thumbnailer - CVE-2013-4568 (bug 58088) Don't normalize U+FF3C to \ in CSS Checks - CVE-2013-6452 (bug 57550) Disallow stylesheets in SVG Uploads - CVE-2013-6453 (bug 58553) Return error on invalid XML for SVG Uploads - CVE-2013-6454 (bug 58472) Disallow -o-link in styles - CVE-2013-6472 (bug 58699) Fix RevDel log entry information leaks - CVE-2013-4572 (bug 53032) Don't cache when a call could autocreate - CVE-2013-4567 (bug 55332) Vertical tab allows bypassing filters - CVE-2013-4568 (bug 55332) "expression" filtering in IE6 bypass - SVG script filtering could be bypassed for Chrome and Firefox clients by using an encoding that MediaWiki understood, but these browsers interpreted as UTF-8. (CVE-2013-2031) - Internal review discovered that extensions were not given the opportunity to disable a password reset, which could lead to circumvention of two-factor authentication (CVE-2013-2032) - (and others) * Replace trademarked image files by self-drawn Free ones * Secure the default images directory (Closes: #716884) * Handle /var/lib/mediawiki/extensions/* always as symlinks, for both core and extra extensions, with upgrade path (Closes: #719208) * Ship files in /etc/mediawiki-extensions/extensions-available/ for extensions shipped with the mediawiki core * Change watch file to track upstream LTS version * debian/control: Change VCS-* URLs (unbreak; point to stable) * Update copyright file with things noted by Paul Tagliamonte, thanks! * Refresh one patch to make it apply cleanly against 1.19.11 . [ Florian Weimer ] * Add “Replaces: mediawiki-extensions-confirmedit” Checksums-Sha1: c61b517425027bc44be1f6dbc6a72ff353152347 2188 mediawiki_1.19.11+dfsg-0+deb7u1.dsc 42d4fa35c6ff582219b180cb69d4099d59eca4f3 12189368 mediawiki_1.19.11+dfsg.orig.tar.xz 033ec597f6cd62848da7ee96345a876489c763fc 50414 mediawiki_1.19.11+dfsg-0+deb7u1.debian.tar.gz 28a2695bd847275cc22008365603e4ad5f9c323b 17927408 mediawiki_1.19.11+dfsg-0+deb7u1_all.deb Checksums-Sha256: d91815807eb61087e376b8fcfde170f51d59f6276e0481ed6188509a2bf37b5d 2188 mediawiki_1.19.11+dfsg-0+deb7u1.dsc 14e36582b785269699285b52db3e9bf29ee76e19786250423cc45f0759444a4c 12189368 mediawiki_1.19.11+dfsg.orig.tar.xz 0859ecb375816910f5db6494efdfbaa44c6617b59dad9e68d2c7af4023fa9288 50414 mediawiki_1.19.11+dfsg-0+deb7u1.debian.tar.gz 8b3dbbbed99d384139cbd1b7809bf55c43964c2ff34c066ab706b0a0e2bde45c 17927408 mediawiki_1.19.11+dfsg-0+deb7u1_all.deb Files: 1f37cd4cf3bc9d682c834a9e9b825c29 2188 web optional mediawiki_1.19.11+dfsg-0+deb7u1.dsc 9094bd7f18c6beaf29d1122fa6fd16a2 12189368 web optional mediawiki_1.19.11+dfsg.orig.tar.xz 7579dd8418ca77d2fc348fb939bab081 50414 web optional mediawiki_1.19.11+dfsg-0+deb7u1.debian.tar.gz c7275d12037419139ed1cea6fe3d1835 17927408 web optional mediawiki_1.19.11+dfsg-0+deb7u1_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (MirBSD) iQIcBAEBCQAGBQJS+MN0AAoJEHa1NLLpkAfg2uAP/0j3cJ7BDtusb6XlSob9fCsT A1/sz5V7P2eWzk2vqx6bexhyFBLceAQlwWoNhB1IOe8wy7VGxf7+aIeJoqbRr/6T ucHCzq/x/uj3JnRqMXfqFzU9DyS3r+jzaCl9jqpUCMknwxrOFIRWtpXn/AL17dbH 3x5LJvxJQISv/LljPmP1zDF5Wl8Z1jd6ZsRhJtM/0Ws1fpL8Y+omQrngk+1g7sDL AUSVAhHupDJphXG7A7USu7GdvIikGYs9di4HnkUMS+i2VTkzq1Hs2ARxCKuGDAg+ AW7xERrTmWb+6aOfmY8SDUM+iCzmEMq4CcK5syYCRN+g2r/2syGcGfuC1hz/SO4x UUGqDbC6fBqGX1SFz9nLLOlU9naSUfpY9hmmd4iM/1/pMMj8yUkZTHc+16G5HV/w HuDrDrbg5NWnNNWrIfSc5YnhEKVILyo3hQMUWXdaTf0HZD/kIz/HurN+7Z5E/xtP 8xh6ZrO//O/7IhQPHv+Dn0Ur8/HHcyboEzkLlRkdvNGoqcebtvlOAoZKIFWbv/A+ RAw6Ssf5Ybtzk7BQVyCI4b+nNbf38cg2vkHBM+1s2t4nAySG0sv7NzTz16Nh746y 2i2V8+p9FK1eQ+taCKcpu8pkxP1psJxxJfOnWVMlv95u3G7M3BtSEIFYhp877nEc HGP0q0eSE4pzUPlxJYAF =1ki5 -----END PGP SIGNATURE-----
