Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Wikipedia: Mediawiki-announce

MediaWiki security release 1.19.1

 

 

Wikipedia mediawiki-announce RSS feed   Index | Next | Previous | View Threaded


reedy at wikimedia

Jun 13, 2012, 2:19 PM

Post #1 of 1 (925 views)
Permalink
MediaWiki security release 1.19.1

I would like to announce the release of MediaWiki 1.19.1. One security issue
was discovered.

Both Chris Steipp and Formafix discovered that the uselang http parameter
was vulnerable to XSS.

For more details, see https://bugzilla.wikimedia.org/show_bug.cgi?id=36938

Chris Steipp also improved the blacklisting of bad elements in SVG files.
This includes catching known
hostile files, and also disallowing the upload of svg files that include
remote resources.

This is work is part of an on-going effort to prevent exploits being hidden
in uploaded SVG files.

MediaWiki 1.19.1 also received a couple of other non-security bugfixes.

Full release notes:
https://gerrit.wikimedia.org/r/gitweb?p=mediawiki/core.git;a=blob_plain;f=RE
LEASE-NOTES-1.19;hb=1.19.1

https://www.mediawiki.org/wiki/Release_notes/1.19

**********************************************************************
Download:
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.tar.gz

Patch to previous version (1.19.0):
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.patch.gz

GPG signatures:
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.tar.gz.sig
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.1.patch.gz.sig

Public keys:
https://secure.wikimedia.org/keys.html


_______________________________________________
MediaWiki announcements mailing list
To unsubscribe, go to:
https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

Wikipedia mediawiki-announce RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.