~ubuntu-branches/debian/squeeze/mediawiki/squeeze : changes

~ubuntu-branches/debian/squeeze/mediawiki/squeeze » Changes from revision 30

From Revision 30 to 11

Rev	Summary	Authors	Tags	Date
30	CVE-2013-4302: apply patch from upstream to prevent CVE-2013-4302: apply patch from upstream to prevent access to anti-CSRF tokens via JSONP	Jonathan Wiltshire	1:1.15.5-2squeeze6	10 years ago
29	[ Dominik George ] [ Dominik George ] * Security fixes from upstream (Closes: #694998): - CVE-2012-5391 - Prevent session fixation in Special:UserLogin - Prevent linker regex from exceeding backtrack limit	Jonathan Wiltshire	1:1.15.5-2squeeze5	11 years ago
28	Disable CVE-2011-4360.patch, it causes ugly error messages i... Disable CVE-2011-4360.patch, it causes ugly error messages in certain situations. The CVE does not apply to this release.	Jonathan Wiltshire	1:1.15.5-2squeeze4	12 years ago
27	CVE-2011-0047: Protect against a CSS injection vulnerability CVE-2011-0047: Protect against a CSS injection vulnerability (closes: #611787)	Jonathan Wiltshire	1:1.15.5-2squeeze1	13 years ago
26	CVE-2011-0003: Protect against clickjacking by sending the CVE-2011-0003: Protect against clickjacking by sending the X-Frame-Options header in all pages (except normal page views and a few selected special pages). Patch as released by upstream	Jonathan Wiltshire	1:1.15.5-2	13 years ago
25	[ Thorsten Glaser ] [ Thorsten Glaser ] * debian/patches/suppress_warnings.patch: new, suppress warnings about session_start() being called twice also in the PHP error log, not just MediaWiki’s, for example run from FusionForge [ Jonathan Wiltshire ] * New upstream security release: - correctly set caching headers to prevent private data leakage (closes: #590660, LP: #610782) - fix XSS vulnerability in profileinfo.php (closes: #590669, LP: #610819)	Jonathan Wiltshire	1:1.15.5-1	13 years ago
24	[ Thorsten Glaser ] [ Thorsten Glaser ] * debian/control: add Vcs-SVN and Vcs-Browser [ Jonathan Wiltshire ] * debian/source/format: Switch to source format 3.0 (quilt) * debian/rules: Drop CDBS quilt logic * debian_specific_config.patch: Don't just redefine MW_INSTALL_PATH, remove the original definition (LP: #406358) * debian/README.source: document use of quilt and format 3.0 (quilt) * New patch backup_documentation.patch improves documentation of maintenance/dumpBackup.php (closes: #572355) * Standards version 3.9.0 (no changes)	Jonathan Wiltshire	1:1.15.4-2	13 years ago
23	[ Jonathan Wiltshire ] [ Jonathan Wiltshire ] * New upstream security release (closes: #585918). * CVE-2010-1647: Fix a cross-site scripting (XSS) vulnerability which allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer. * CVE-2010-1648: Fix a cross-site request forgery (CSRF) vulnerability in the login interface which allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form. [ Romain Beauxis ] * Put debian's package version in declared version. Should help sysadmins to keep track of installed versions, in particular with regard to security updates. * Added Jonathan Wiltshire to uploaders. * Do not clan math dir if it does not exist (for instance when running clean from SVN).	Romain Beauxis	1:1.15.4-1	13 years ago
22	* New upstream release. * New upstream release. * Fixes security issue: "MediaWiki was found to be vulnerable to login CSRF. An attacker who controls a user account on the target wiki can force the victim to log in as the attacker, via a script on an external website. If the wiki is configured to allow user scripts, say with "$wgAllowUserJs = true" in LocalSettings.php, then the attacker can proceed to mount a phishing-style attack against the victim to obtain their password."	Romain Beauxis	1:1.15.3-1	14 years ago
21	* New upstream release. * New upstream release. * Fixes security issue: "Two security issues were discovered: A CSS validation issue was discovered which allows editors to display external images in wiki pages. This is a privacy concern on public wikis, since a malicious user may link to an image on a server they control, which would allow that attacker to gather IP addresses and other information from users of the public wiki. All sites running publicly-editable MediaWiki installations are advised to upgrade. All versions of MediaWiki (prior to this one) are affected. A data leakage vulnerability was discovered in thumb.php which affects wikis which restrict access to private files using img_auth.php, or some similar scheme. All versions of MediaWiki since 1.5 are affected." * Updated standards. * Removed section about upgrading from mediawiki1.x packages in README.Debian since they do not exist in any supported distribution anymore. * Switched php5-gd and imagemagick in Suggests. Closes: #542008 * Backported patch from revision 51083 to fix a bug with invalid titles. Closes: #537134 * Backported patch from revision 61090 to add a unique guid per RSS feed element. Closes: #383130 * Refreshed patches.	Romain Beauxis	1:1.15.2-1	14 years ago
20	* New upstream release. * New upstream release. * Ack previous NMU, thanks to Nico Golde for taking care of this.	Romain Beauxis		14 years ago
19	* Non-maintainer upload by the Security Team. * Non-maintainer upload by the Security Team. * Fix cross-site scripting in [[Special:Block]] (No CVE id yet; XSS-no-CVE.patch; Closes: #537634).	Nico Golde	1:1.15.0-1.1	14 years ago
18	* New upstream release. * New upstream release. * Upstream added support for OASIS documents. Closes: #530328 * Refreshed quilt patches * Bumped standards versions to 3.8.2 * Bumped compat to 7 * Pointed to GPL-2 in debian/copyright * Added php5-sqlite to possible DB backend dependencies. Closes: #501569 * Proofread README.Debian, upgrade is documented there. Closes: #520121	Romain Beauxis		14 years ago
17	* New upstream release. * New upstream release. * Fixed issues in the installer: "A number of cross-site scripting (XSS) security vulnerabilities were discovered in the web-based installer (config/index.php). These vulnerabilities all require a live installer once the installer has been used to install a wiki, it is deactivated. Note that cross-site scripting vulnerabilities can be used to attack any website in the same cookie domain. So if you have an uninstalled copy of MediaWiki on the same site as an active web service, MediaWiki could be used to attack the active service." Closes: #514547 * Fixed typo in README.Debian Closes: #515192 * Updated japanese debconf translation, thanks to Hideki Yamane Closes: #510896 * Added a file in debian/copyright	Romain Beauxis		15 years ago
16	* New upstream release. * New upstream release. * Fix CVE-2008-5249: XSS vulnerability in MediaWiki: "An XSS vulnerability affecting all MediaWiki installations between 1.13.0 and 1.13.2." Closes: #508868 * Fix CVE-2008-5250: several local script injection vulnerabilities in MediaWiki: "o A local script injection vulnerability affecting Internet Explorer clients for all MediaWiki installations with uploads enabled. o A local script injection vulnerability affecting clients with SVG scripting capability (such as Firefox 1.5+), for all MediaWiki installations with SVG uploads enabled." Closes: #508869 * Fix CVE-2008-5252: CSRF vulnerability affecting the Special:Import feature in MediaWiki: "A CSRF vulnerability affecting the Special:Import feature, for all MediaWiki installations since the feature was introduced in 1.3.0." Closes: #508870	Romain Beauxis		15 years ago
15	* New upstream release * New upstream release * Fix CVE-2008-4408: XSS in mediawiki: "Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the useskin parameter to an unspecified component." Closes: #501115	Romain Beauxis	1:1.13.2-1	15 years ago
14	* Fixed postgresql dependency * Fixed postgresql dependency Closes: #472987 * Added instructions to install and upgrade Closes: #472990, #472831	Romain Beauxis	1:1.12.0-2	16 years ago
13	* Added patch to fix pgsql select, thanks to Marc Dequènes * Added patch to fix pgsql select, thanks to Marc Dequènes Closes: #469841 * Upated README.Debian to mention php5-gd instead of php5-gd2 and texlive-latex-base instead to tetex-bin. Closes: #469558 * still setting urgency to high since previous upload didn't make it to testing.	Romain Beauxis	1:1.11.2-2	16 years ago
12	* New upstream release * New upstream release * A potential XSS injection vector affecting Microsoft Internet Explorer users has been closed.	Romain Beauxis	1:1.11.1-1	16 years ago
11	Initial upload of 1.11.0 to unstable Initial upload of 1.11.0 to unstable	Romain Beauxis	1:1.11.0-2	16 years ago

Older »