CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
EPSS
Percentile
74.7%
Gerfried Fuchs uploaded new packages for mediawiki which fixed the
following security problems:
CVE-2008-5249, Debian BTS #508868
Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through
1.13.2 allows remote attackers to inject arbitrary web script or HTML
via unspecified vectors.
CVE-2008-5250, Debian BTS #508869
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11,
1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer
is used and uploads are enabled, or an SVG scripting browser is used
and SVG uploads are enabled, allows remote authenticated users to
inject arbitrary web script or HTML by editing a wiki page.
CVE-2008-5252, Debian BTS #508870
Cross-site request forgery (CSRF) vulnerability in the Special:Import
feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and
1.13.x before 1.13.3 allows remote attackers to perform unspecified
actions as authenticated users via unknown vectors.
CVE-2008-5687
MediaWiki 1.11, and other versions before 1.13.3, does not properly
protect against the download of backups of deleted images, which might
allow remote attackers to obtain sensitive information via requests
for files in images/deleted/.
CVE-2009-0737, Debian BTS #514547
Multiple cross-site scripting (XSS) vulnerabilities in the web-based
installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12
before 1.12.4, and 1.13 before 1.13.4, when the installer is in active
use, allow remote attackers to inject arbitrary web script or HTML via
unspecified vectors.
For the etch-backports distribution the problems have been fixed in
version 1:1.12.0-2lenny3~bpo40+1.
For the squeeze and sid distributions all problems but CVE-2009-0737
(see #514547) have been fixed in version 1:1.13.3-1.
If you don't use pinning (see [1]) you have to update the packages
manually via "apt-get -t etch-backports install <packagelist>" with the
packagelist of your installed packages affected by this update.
[1] <http://backports.org/dokuwiki/doku.php?id=instructions>
We recommend to pin the backports repository to 200 so that new versions
of installed backports will be installed automatically:
Package: *
Pin: release a=etch-backports
Pin-Priority: 200
Attachment:
signature.asc
Description: Digital signature
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 999 | hppa | mediawiki-math | < 1:1.13.3-1 | mediawiki-math_1:1.13.3-1_hppa.deb |
Debian | 5 | powerpc | mediawiki-math | < 1:1.12.0-2lenny3 | mediawiki-math_1:1.12.0-2lenny3_powerpc.deb |
Debian | 6 | ia64 | mediawiki-math | < 1:1.13.3-1 | mediawiki-math_1:1.13.3-1_ia64.deb |
Debian | 6 | s390 | mediawiki-math | < 1:1.13.3-1 | mediawiki-math_1:1.13.3-1_s390.deb |
Debian | 5 | alpha | mediawiki-math | < 1:1.12.0-2lenny2 | mediawiki-math_1:1.12.0-2lenny2_alpha.deb |
Debian | 5 | i386 | mediawiki-math | < 1:1.12.0-2lenny2 | mediawiki-math_1:1.12.0-2lenny2_i386.deb |
Debian | 4 | mipsel | mediawiki1.7-math | < 1.7.1-9etch1 | mediawiki1.7-math_1.7.1-9etch1_mipsel.deb |
Debian | 5 | alpha | mediawiki-math | < 1:1.12.0-2lenny3 | mediawiki-math_1:1.12.0-2lenny3_alpha.deb |
Debian | 6 | alpha | mediawiki-math | < 1:1.13.3-1 | mediawiki-math_1:1.13.3-1_alpha.deb |
Debian | 999 | powerpc | mediawiki-math | < 1:1.13.3-1 | mediawiki-math_1:1.13.3-1_powerpc.deb |