Debian: DSA-2891-3 Important Fixes for MediaWiki Regresions and Attacks

Several vulnerabilities were discovered in MediaWiki, a wiki engine.
The Common Vulnerabilities and Exposures project describers the followin
issues:

CVE-2013-2031

Cross-site scripting attack via valid UTF-7 encoded sequences
in a SVG file.

CVE-2013-4567 & CVE-2013-4568

Kevin Israel (Wikipedia user PleaseStand) reported two ways
to inject Javascript due to an incomplete blacklist in the
CSS sanitizer function.

CVE-2013-4572

MediaWiki and the CentralNotice extension were incorrectly setting
cache headers when a user was autocreated, causing the user's
session cookies to be cached, and returned to other users.

CVE-2013-6452

Chris from RationalWiki reported that SVG files could be
uploaded that include external stylesheets, which could lead to
XSS when an XSL was used to include JavaScript.

CVE-2013-6453

MediaWiki's SVG sanitization could be bypassed when the XML was
considered invalid.

CVE-2013-6454

MediaWiki's CSS sanitization did not filter -o-link ...