MediaWiki Multiple Vulnerabilities Fixed by 1.25.2, 1.24.3 and 1.23.10
Description
(#Multiple vulnerabilities were reported in MediaWiki:#- CVE-2015-6727: information disclosure in "Special:DeletedContributions" allowing a remote attacker to know if an IP address has been blocked#- CVE-2015-6728: anti-CSRF feature bypass via a timing attack which allows a remote attacker to modify user's watchlist#- CVE-2015-6729 and CVE-2015-6730: cross-site scripting located in the "thumb.php" web page.##The mediawiki packages provided by Debian Squeeze 6, Wheezy 7 and Jessie 8 are vulnerable.#Updated, 14/08/2015:#The mediawiki123, mediawiki124 and mediawiki125 packages provided by FreeBSD are vulnerable.#Updated, 27/08/2015:#Several vulnerabilities, fixed by the same versions of Mediawiki, have been added:#- CVE-2015-6731 and CVE-2015-6732: several cross-site scripting in "SemanticForms" extension#- CVE-2015-6733: system resource consumption in "SyntaxHighlight_GeSHi" extension#- CVE-2015-6734: cross-site scripting located in "keywords-1" parameter of "cssgen.php" web page in "SyntaxHighlight_GeSHi" extension#- CVE-2015-6735: denial of service in "TimedMediaHandler" extension#- CVE-2015-6736: denial of service in "Quiz" extension#- CVE-2015-6737: cross-site scripting in "Widgets" extension.##The mediawiki packages provided by Debian Squeeze 6, Wheezy 7 and Jessie 8 are vulnerable.#Updated, 28/08/2015:#CVE-2013-7444 has been assigned in addition of CVE-2015-6727 vulnerability.##The mediawiki packages provided by Debian Squeeze 6, Wheezy 7 and Jessie 8 are affected by CVE-2013-7444.#Updated, 06/06/2016:#Contrarily to the statement above, the mediawiki packages provided by Debian Jessie 8 are not vulnerable.)
