oss-security - Re: CVE request: Server-side arbitrary script inclusion vulnerability in MediaWiki <=1.16.1

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1418086390.282600.1296749422278.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Thu, 3 Feb 2011 11:10:22 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: CVE request: Server-side arbitrary script
 inclusion vulnerability in MediaWiki <=1.16.1

Please use CVE-2011-0537

Thanks.

-- 
    JB


----- Original Message -----
> Greetings,
> 
> MediaWiki 1.16.2 was just released as a security update for two
> vulnerabilities. One already has a CVE, but this one still needs one:
> 
> "An arbitrary script inclusion vulnerability was discovered. The
> vulnerability only allows execution of files with names ending in
> ".php" which are already present in the local filesystem. Only servers
> running Microsoft Windows and possibly Novell Netware are affected.
> Despite these mitigating factors, all users are advised to upgrade,
> since there is a risk of complete server compromise. MediaWiki 1.8.0
> and later is affected. For more details, see bug 27094"
> 
> https://bugzilla.wikimedia.org/show_bug.cgi?id=27094
> 
> Thanks,
> ~reed
> 
> --
> Reed Loden
> reed@...dloden.com

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.