Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 3 Feb 2011 11:10:22 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: CVE request: Server-side arbitrary script
 inclusion vulnerability in MediaWiki <=1.16.1

Please use CVE-2011-0537

Thanks.

-- 
    JB


----- Original Message -----
> Greetings,
> 
> MediaWiki 1.16.2 was just released as a security update for two
> vulnerabilities. One already has a CVE, but this one still needs one:
> 
> "An arbitrary script inclusion vulnerability was discovered. The
> vulnerability only allows execution of files with names ending in
> ".php" which are already present in the local filesystem. Only servers
> running Microsoft Windows and possibly Novell Netware are affected.
> Despite these mitigating factors, all users are advised to upgrade,
> since there is a risk of complete server compromise. MediaWiki 1.8.0
> and later is affected. For more details, see bug 27094"
> 
> https://bugzilla.wikimedia.org/show_bug.cgi?id=27094
> 
> Thanks,
> ~reed
> 
> --
> Reed Loden
> reed@...dloden.com

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ