This bug was fixed in the package mediawiki - 1:1.15.1-1ubuntu3
---------------
mediawiki (1:1.15.1-1ubuntu3) maverick; urgency=low
* SECURITY UPDATE: A CSRF vulnerability was discovered in our login
interface. Although regular logins are protected as of 1.15.3, it was
discovered that the account creation and password reset features were not
protected from CSRF. This could lead to unauthorised access to private
wikis. (LP: #586773)
- debian/patches/CSRF-Special-Userlogin-no-CVE_rev-66991.patch
- patch from upstream SVN rev. 66991
-
http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html
- https://bugzilla.wikimedia.org/show_bug.cgi?id=23371
* SECURITY UPDATE: Noncompliant CSS parsing behaviour in Internet Explorer
allows attackers to construct CSS strings which are treated as safe by
previous versions of MediaWiki, but are decoded to unsafe strings by
Internet Explorer. (LP: #586773)
- debian/patches/XSS-IE-no-CVE_rev-66992.patch
- patch from upstream SVN rev. 66992
-
http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html
- https://bugzilla.wikimedia.org/show_bug.cgi?id=23687
-- Andreas Wenning <[email protected]> Mon, 31 May 2010 00:49:46 +0200
** Changed in: mediawiki (Ubuntu Maverick)
Status: In Progress => Fix Released
** Bug watch added: MediaWiki bug tracker #23371
https://bugzilla.wikipedia.org/show_bug.cgi?id=23371
** Bug watch added: MediaWiki bug tracker #23687
https://bugzilla.wikipedia.org/show_bug.cgi?id=23687
--
CSRF and XSS vulnerability; new version 1.15.4 released
https://bugs.launchpad.net/bugs/586773
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
