Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 426500 (CVE-2012-2698) - <www-apps/mediawiki-1.19.1: XSS in includes/SkinTemplate.php (CVE-2012-2698)
Summary: <www-apps/mediawiki-1.19.1: XSS in includes/SkinTemplate.php (CVE-2012-2698)
Status: RESOLVED FIXED
Alias: CVE-2012-2698
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2012-07-13 23:53 UTC by GLSAMaker/CVETool Bot
Modified: 2012-08-09 16:56 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2012-07-13 23:53:05 UTC 
CVE-2012-2698 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2698):
  Cross-site scripting (XSS) vulnerability in the outputPage function in
  includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.8.x before 1.18.4,
  and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web
  script or HTML via the uselang parameter to index.php/Main_page.


@web-apps, Christian: may we stabilize =www-apps/mediawiki-1.18.4 ?
Comment 1 Tim Harder gentoo-dev 2012-07-15 04:53:36 UTC 
(In reply to comment #0)
> @web-apps, Christian: may we stabilize =www-apps/mediawiki-1.18.4 ?

I think we can just stabilize mediawiki-1.19.1 instead.
Comment 2 Sean Amoss (RETIRED) gentoo-dev Security 2012-07-20 17:01:42 UTC 
(In reply to comment #1)
> (In reply to comment #0)
> > @web-apps, Christian: may we stabilize =www-apps/mediawiki-1.18.4 ?
> 
> I think we can just stabilize mediawiki-1.19.1 instead.

Thanks, Tim.

Arches, please test and mark stable:
=www-apps/mediawiki-1.19.1
Target Keywords: "amd64 ppc x86"
Comment 3 Jeff (JD) Horelick (RETIRED) gentoo-dev 2012-07-21 09:33:42 UTC 
x86 stable
Comment 4 Agostino Sarubbo gentoo-dev 2012-07-28 16:57:27 UTC 
amd64 stable
Comment 5 Brent Baude (RETIRED) gentoo-dev 2012-08-09 16:38:47 UTC 
ppc done
Comment 6 Sean Amoss (RETIRED) gentoo-dev Security 2012-08-09 16:56:09 UTC 
Thanks, everyone.

Closing noglsa for XSS.