[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAKcmtDw0ddyQBazv1=k+nTA6WaEP70kd3MT8baSA5S36CdJYrg@mail.gmail.com>
Date: Wed, 3 Dec 2014 12:57:58 -0800
From: Chris Steipp <csteipp@...imedia.org>
To: oss-security@...ts.openwall.com
Subject: MediaWiki security release - 1.23.7
Hi, we fixed a few security bugs in last week's MediaWiki release [1].
Two of them I think should have CVE's:
* bug 71111 / T73111 - A missing csrf check could allow reflected xss
on wikis that allow raw html
(https://phabricator.wikimedia.org/T73111)
* bug 71478 / T73478 - MediaWiki's <cross-domain-policy> mangling
could allow an article editor to inject code into api consumers that
blindly unserialize php representations of the page from the api
(https://phabricator.wikimedia.org/T73478)
Could those be assigned?
[1] - https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
