| Summary: | <www-apps/mediawiki-{1.23.10,1.24.3,1.25.2}: multiple vulnerabilities (CVE-2015-{2931,2932,2933,2934,2935,2936,2937,2938,2939,2940,2941,2942}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | dev-zero, web-apps |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html | ||
| Whiteboard: | B3 [glsa cve] | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | 557844 | ||
| Bug Blocks: | |||
CVE-2015-2942 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2942): MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937. CVE-2015-2941 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2941): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value. CVE-2015-2940 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2940): Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors. CVE-2015-2939 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2939): Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace. CVE-2015-2938 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2938): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file. CVE-2015-2937 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2937): MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942. CVE-2015-2936 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2936): MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password. CVE-2015-2935 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2935): MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT." CVE-2015-2934 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2934): MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file. CVE-2015-2933 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2933): Cross-site scripting (XSS) vulnerability in the Html class in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a LanguageConverter substitution string when using a language variant. CVE-2015-2932 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2932): Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element. CVE-2015-2931 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2931): Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI. Versions 1.24.2, 1.23.9, and 1.19.24 are now in the tree, 1.22.x is eol. More vulnerabilities found, continuing in Bug #557844 GLSA Vote: Yes (In reply to Yury German from comment #4) > GLSA Vote: Yes GLSA Vote: Yes This issue was resolved and addressed in GLSA 201510-05 at https://security.gentoo.org/glsa/201510-05 by GLSA coordinator Kristian Fiskerstrand (K_F). |
From ${URL} : == Security fixes == * iSEC Partners discovered a way to circumvent the SVG MIME blacklist for embedded resources (iSEC-WMF1214-11). This allowed an attacker to embed JavaScript in the SVG. The issue was additionally identified by Mario Heiderich / Cure53. MIME types are now whitelisted. <https://phabricator.wikimedia.org/T85850> * MediaWiki user Bawolff pointed out that the SVG filter to prevent injecting JavaScript using animate elements was incorrect. <https://phabricator.wikimedia.org/T86711> * MediaWiki user Bawolff reported a stored XSS vulnerability due to the way attributes were expanded in MediaWiki's Html class, in combination with LanguageConverter substitutions. <https://phabricator.wikimedia.org/T73394> * Internal review discovered that MediaWiki's SVG filtering could be bypassed with entity encoding under the Zend interpreter. This could be used to inject JavaScript. This issue was also discovered by Mario Gomes from Beyond Security. <https://phabricator.wikimedia.org/T88310> * iSEC Partners discovered a XSS vulnerability in the way api errors were reflected when running under HHVM versions before 3.6.1 (iSEC-WMF1214-8). MediaWiki now detects and mitigates this issue on older versions of HHVM. <https://phabricator.wikimedia.org/T85851> * Internal review and iSEC Partners discovered (iSEC-WMF1214-1) that MediaWiki versions using PBKDF2 for password hashing (the default since 1.24) are vulnerable to DoS attacks using extremely long passwords. <https://phabricator.wikimedia.org/T64685> * iSEC Partners discovered that MediaWiki's SVG and XMP parsing, running under HHVM, was susceptible to "Billion Laughs" DoS attacks (iSEC-WMF1214-13). <https://phabricator.wikimedia.org/T85848> * Internal review found that MediaWiki is vulnerable to "Quadratic Blowup" DoS attacks, under both HHVM and Zend PHP. <https://phabricator.wikimedia.org/T71210> * iSEC Partners discovered a way to bypass the style filtering for SVG files (iSEC-WMF1214-3). This could violate the anonymity of users viewing the SVG. <https://phabricator.wikimedia.org/T85349> * iSEC Partners reported that the MediaWiki feature allowing a user to preview another user's custom JavaScript could be abused for privilege escalation (iSEC-WMF1214-10). This feature has been removed. <https://phabricator.wikimedia.org/T85855> Additionally, the following extensions have been updated to fix security issues: * Extension:Scribunto - MediaWiki user Jackmcbarn discovered that function names were not sanitized in Lua error backtraces, which could lead to XSS. <https://phabricator.wikimedia.org/T85113> * Extension:CheckUser - iSEC Partners discovered that the CheckUser extension did not prevent CSRF attacks on the form allowing checkusers to look up sensitive information about other users (iSEC-WMF1214-6). Since the use of CheckUser is logged, the CSRF could be abused to defame a trusted user or flood the logs with noise. <https://phabricator.wikimedia.org/T85858> @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.