~ubuntu-branches/ubuntu/intrepid/mediawiki/intrepid-security : changes

~ubuntu-branches/ubuntu/intrepid/mediawiki/intrepid-security » Changes from revision 19

From Revision 17

Rev	Summary	Authors	Tags	Date
17	* SECURITY UPDATE: Multiple cross-site scripting (XSS) vulne... * SECURITY UPDATE: Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php). (LP: #348858) - CVE-2009-0737 - debian/patches/CVE-2009-0737.patch - patch taken directly from Debian - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514547 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-February/000083.html	Andreas Wenning	1:1.12.0-2ubuntu0.3	15 years ago
16	* SECURITY UPDATE: * SECURITY UPDATE: - CVE-2008-5249 - CVE-2008-5250 - CVE-2008-5252 - other security-related problems (see full patch description). - patch taken directly from Debian - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508870 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508869 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html * debian/patches/CVE-2008-5249_CVE-2008-5250_CVE-2008-5252.patch: - Fixed output escaping for reporting of non-MediaWiki exceptions. Potential XSS if an extension throws one of these with user input. - Avoid fatal error in profileinfo.php when not configured. - Fixed CSRF vulnerability in Special:Import. Fixed input validation in transwiki import feature. - Add a .htaccess to deleted images directory for additional protection against exposure of deleted files with known SHA-1 hashes on default installations. - Fixed XSS vulnerability for Internet Explorer clients, via file uploads which are interpreted by IE as HTML. - Fixed XSS vulnerability for clients with SVG scripting, on wikis where SVG uploads are enabled. Firefox 1.5+ is affected. - Avoid streaming uploaded files to the user via index.php. This allows security-conscious users to serve uploaded files via a different domain, and thus client-side scripts executed from that domain cannot access the login cookies. Affects Special:Undelete, img_auth.php and thumb.php. - When streaming files via index.php, use the MIME type detected from the file extension, not from the data. This reduces the XSS attack surface. - Blacklist redirects via Special:Filepath. Such redirects exacerbate any XSS vulnerabilities involving uploads of files containing scripts.	Andreas Wenning	1:1.12.0-2ubuntu0.2	15 years ago
15	* SECURITY UPDATE: * SECURITY UPDATE: Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.1, 1.12.0, and possibly other versions before 1.13.2 allows remote attackers to inject arbitrary web script or HTML via the useskin parameter to an unspecified component. (LP: #290015) - debian/patches/CVE-2008-4408.patch: Address XSS vulnerability. Based on upstream/Debian patch. - CVE-2008-4408 - http://svn.wikimedia.org/viewvc/mediawiki?view=rev&revision=41540 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501115	Iain Lane	1:1.12.0-2ubuntu0.1	15 years ago
14	* Fixed postgresql dependency * Fixed postgresql dependency Closes: #472987 * Added instructions to install and upgrade Closes: #472990, #472831	Romain Beauxis	1:1.12.0-2	16 years ago
13	* Added patch to fix pgsql select, thanks to Marc Dequènes * Added patch to fix pgsql select, thanks to Marc Dequènes Closes: #469841 * Upated README.Debian to mention php5-gd instead of php5-gd2 and texlive-latex-base instead to tetex-bin. Closes: #469558 * still setting urgency to high since previous upload didn't make it to testing.	Romain Beauxis	1:1.11.2-2	16 years ago
12	* New upstream release * New upstream release * A potential XSS injection vector affecting Microsoft Internet Explorer users has been closed.	Romain Beauxis	1:1.11.1-1	16 years ago
11	Initial upload of 1.11.0 to unstable Initial upload of 1.11.0 to unstable	Romain Beauxis	1:1.11.0-2	16 years ago
10	* Switched to mediawiki1.10 * Switched to mediawiki1.10 * Mediawiki1.10 recommends mediawiki-math (Closes: #428021)	Romain Beauxis	1:1.10	16 years ago
9	* Switched to mediawiki1.9, closes: #392932 * Switched to mediawiki1.9, closes: #392932 * Corrected typo in control, closes: #414121 * Seperated -math extension to a single package, closes: #401714	Romain Beauxis	1:1.9	17 years ago
8	Initial Release Initial Release	Romain Beauxis	1:1.7	17 years ago
7	New upstream security release. New upstream security release.	Marc Dequènes (Duck)	1.4.15-1	18 years ago
6	Added 03_config_fix.patch to fix symlink issue Added 03_config_fix.patch to fix symlink issue (Closes: #30075)	Peter Savage	1.4.14-1ubuntu1	18 years ago
5	* New upstream security release. * New upstream security release. * Removed 03_bad_version.patch.	Marc Dequènes (Duck)	1.4.14-1	18 years ago
4	* New upstream security release (Closes: #345280). * New upstream security release (Closes: #345280). * Exclude texvc/texvc.bc from dh_shlibdeps processing, it now strangely fails (temporary solution for fast security upload, further analisys later).	Marc Dequènes (Duck)	1.4.13-1	18 years ago
3	[ Marc Dequènes (Duck) ] [ Marc Dequènes (Duck) ] * New upstream security release. * Bad version number in Special:Version page fixed by new upstream release (Closes: #335177). * Fixed configuration URL in 'debian/README.Debian' (Closes: #334131). [ Romain Beauxis ] * Build texvc bytecode on architectures where a native ocaml compiler does not exist (and generate correct dependencies as well) (Closes: #332531).	Marc Dequènes (Duck)	1.4.12-1	18 years ago
2	* New upstream release * New upstream release * Fixed incorrect build dependencies	Romain Beauxis	1.4.10-1	18 years ago
1	Import upstream version 1.4.10 Import upstream version 1.4.10	Romain Beauxis	upstream-1.4.10	18 years ago