security advisorycritical issueDebian
It was reported that MediaWiki, a website engine for collaborative work, allowed to load user-created CSS on pages where user-created JavaScript is not allowed. A wiki user could be tricked into performing actions by manipulating the interface from CSS, or JavaScript code being executed . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3046-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Salvatore Bonaccorso October 05, 2014 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : mediawiki CVE ID : CVE-2014-7295 It was reported that MediaWiki, a website engine for collaborative work, allowed to load user-created CSS on pages where user-created JavaScript is not allowed. A wiki user could be tricked into performing actions by manipulating the interface from CSS, or JavaScript code being executed from CSS, on security-wise sensitive pages like Special:Preferences and Special:UserLogin. This update removes the separation of CSS and JavaScript module allowance. For the stable distribution (wheezy), this problem has been fixed in version 1:1.19.20+dfsg-0+deb7u1. For the unstable distribution (sid), this problem has been fixed in version 1:1.19.20+dfsg-1. We recommend that you upgrade your mediawiki packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . - ------------------------------------------------------------------------- Debian Security Advisory. reported, mediawiki, website, engine, collaborative, allowed, user-create. . Severity: Important. LinuxSecurity.com Team
Oct 05, 2014
•Important
Debian