== Security fixes == * Internal review discovered that Special:DeletedContributions did not properly protect the IP of autoblocked users. This fix makes the functionality of Special:DeletedContributions consistent with Special:Contributions and Special:BlockList. <https://phabricator.wikimedia.org/T106893> * Internal review discovered that watchlist anti-csrf tokens were not being compared in constant time, which could allow various timing attacks. This could allow an attacker to modify a user's watchlist via csrf. <https://phabricator.wikimedia.org/T94116> * John Menerick reported that MediaWiki's thumb.php failed to sanitize various error messages, resulting in xss. <https://phabricator.wikimedia.org/T97391> Additionally, the following extensions have been updated to fix security issues: * Extension:SemanticForms - MediaWiki user Grunny discovered multiple reflected xss vectors in SemanticForms. Further internal review discovered and fixed other reflected and stored xss vectors. <https://phabricator.wikimedia.org/T103391> <https://phabricator.wikimedia.org/T103765> <https://phabricator.wikimedia.org/T103761> * Extension:SyntaxHighlight_GeSHi - xss and potential DoS vectors. Internal review discovered that the contib directory for GeSHi was re-included in MediaWiki 1.25. Some scripts could be potentially be used for DoS, and DAU Huy Ngoc discovered an xss vector. All contrib scripts have been removed. <https://phabricator.wikimedia.org/T108198> * Extension:TimedMediaHandler - User:McZusatz reported that resetting transcodes deleted the transcode without creating a new one, which could be used for vandalism or potentially DoS. <https://phabricator.wikimedia.org/T100211> * Extension:Quiz - Internal review discovered that Quiz did not properly escape regex metacharacters in a user controlled regular expression, enabling a DoS vector. <https://phabricator.wikimedia.org/T97083> * Extension:Widgets - MediaWiki developer Majr reported a potential HTML injection (xss) vector. <https://phabricator.wikimedia.org/T88964>
Please note that 1.19 EOL'd since 2015-05-25.
CVE Request - http://seclists.org/oss-sec/2015/q3/332
Arches please stabilize. You can probably stabilize all three versions since we'll probably drop 1.19 and 1.22 after this.
(In reply to Tim Harder from comment #3) > Arches please stabilize. > > You can probably stabilize all three versions since we'll probably drop 1.19 > and 1.22 after this. Tim, next time please clearly state the exactly version that needs stabilization. Thanks.
amd64 stable
x86 stable
ppc stable. Maintainer(s), please cleanup. Security, please vote.
GLSA Vote: Yes
(In reply to Yury German from comment #8) > GLSA Vote: Yes Yes, already approved for bug 545944
This issue was resolved and addressed in GLSA 201510-05 at https://security.gentoo.org/glsa/201510-05 by GLSA coordinator Kristian Fiskerstrand (K_F).