Bug 466124 – <www-apps/mediawiki-{1.19.5,1.20.4} XSS/XXE (CVE-2013-1951)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Enno Gröper 2013-04-16 17:04:05 UTC]

Yesterday Mediawiki published security releases, that fix 3 security issues:

* An internal review discovered that specially crafted Lua function
names could lead to XSS.
<https://bugzilla.wikimedia.org/show_bug.cgi?id=46084>

* Daniel Franke reported that during SVG parsing, MediaWiki failed to
prevent XML external entity (XXE) processing. This could lead to local
file disclosure, or potentially remote command execution in
environments that have enabled expect:// handling.
<https://bugzilla.wikimedia.org/show_bug.cgi?id=46859>

* Internal review also discovered that Special:Import, and
Extension:RSS failed to prevent XML external entity (XXE) processing.
<https://bugzilla.wikimedia.org/show_bug.cgi?id=47251>

Reproducible: Always

[Comment 1 Tim Harder 2013-04-17 00:28:46 UTC]

Arches, please stabilize:
=www-apps/mediawiki-1.19.5
=www-apps/mediawiki-1.20.4

[Comment 2 Alex Legler (RETIRED) 2013-04-17 08:52:47 UTC]

*** Bug 466090 has been marked as a duplicate of this bug. ***

[Comment 3 Agostino Sarubbo 2013-04-17 09:12:53 UTC]

amd64 stable

[Comment 4 Agostino Sarubbo 2013-04-17 09:13:08 UTC]

x86 stable

[Comment 5 Agostino Sarubbo 2013-04-17 09:13:23 UTC]

ppc stable

[Comment 6 Sergey Popov (RETIRED) 2013-08-23 10:18:59 UTC]

Thanks for your work

Possible remote code execution

GLSA vote: yes

[Comment 7 GLSAMaker/CVETool Bot 2013-10-28 17:08:35 UTC]

This issue was resolved and addressed in
 GLSA 201310-21 at http://security.gentoo.org/glsa/glsa-201310-21.xml
by GLSA coordinator Sergey Popov (pinkbyte).