It was discovered that MIME types were not properly restricted, allowing
a way to circumvent the SVG MIME blacklist for embedded resources. This
allowed an attacker to embed JavaScript in a SVG file.
The SVG filter to prevent injecting JavaScript using animate elements
was incorrect. The list of dangerous parts of HTML5 is supposed to
include all uses of ‘animate attributename="xlink:href"’ in SVG documents.
A persistent XSS vulnerability was discovered due to the way attributes
were expanded in MediaWiki’s HTML class, in combination with
LanguageConverter substitutions.
It was discovered that MediaWiki’s SVG filtering could be bypassed with
entity encoding under the Zend interpreter. This could be used to inject
JavaScript.
A way was discovered to bypass the style filtering for SVG files to load
external resource. This could violate the anonymity of users viewing the
SVG. This issue exists because of an incomplete fix for CVE-2014-7199.
It was discovered that MediaWiki versions using PBKDF2 for password
hashing (the default since 1.24) are vulnerable to DoS attacks using
extremely long passwords.
It was discovered that MediaWiki is vulnerable to "Quadratic Blowup"
denial of service attacks.
It was discovered that the MediaWiki feature allowing a user to preview
another user’s custom JavaScript could be abused for privilege
escalation. This feature has been removed.
It was discovered that function names were not sanitized in Lua error
backtraces, which could lead to XSS.
It was discovered that the CheckUser extension did not prevent CSRF
attacks on the form allowing checkusers to look up sensitive information
about other users. Since the use of CheckUser is logged, the CSRF could
be abused to defame a trusted user or flood the logs with noise.
It was discovered that XSS is possible in the way api errors were
reflected under HHVM versions before 3.6.1. MediaWiki now detects and
mitigates this issue on older versions of HHVM.
It was discovered that MediaWiki’s SVG and XMP parsing running under
HHVM was susceptible to "Billion Laughs" DoS attacks.
seclists.org/oss-sec/2015/q2/61
access.redhat.com/security/cve/CVE-2015-2931
access.redhat.com/security/cve/CVE-2015-2932
access.redhat.com/security/cve/CVE-2015-2933
access.redhat.com/security/cve/CVE-2015-2934
access.redhat.com/security/cve/CVE-2015-2935
access.redhat.com/security/cve/CVE-2015-2936
access.redhat.com/security/cve/CVE-2015-2937
access.redhat.com/security/cve/CVE-2015-2938
access.redhat.com/security/cve/CVE-2015-2939
access.redhat.com/security/cve/CVE-2015-2940
access.redhat.com/security/cve/CVE-2015-2941
access.redhat.com/security/cve/CVE-2015-2942
lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html