Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 22 May 2013 11:30:30 +0200
From: Thijs Kinkhorst <>
Subject: CVE request: MediaWiki chunked uploads vulnerability


Can a CVE name be assigned for the following MediaWiki issue please?


----------  Doorgestuurd bericht  ----------

Onderwerp: [MediaWiki-announce] MediaWiki Security Release: 1.20.6 and 1.19.7
Datum: dinsdag 21 mei 2013, 22:14:52
Van: Chris Steipp <>
Aan:, "MediaWiki-l" <mediawiki->, Wikimedia developers <>

I would like to announce the release of MediaWiki 1.20.6 and 1.19.7.
These releases fix a security related issue that could affect users of
MediaWiki. Download links are given at the end of this email.

* MediaWiki user Marco discovered that security checks for file
uploads were not being run when the file was uploaded in chunks
through the API. This option has been available to users who can
upload files since MediaWiki 1.19.

Full release notes for 1.20.6:

Full release notes for 1.19.7:

For information about how to upgrade, see


Patch to previous version (1.20.5):

GPG signatures:

Public keys:


Patch to previous version (1.19.6):

GPG signatures:

Public keys:

MediaWiki announcements mailing list
To unsubscribe, go to:


Download attachment "signature.asc " of type "application/pgp-signature" (491 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.