Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 3 Dec 2014 12:57:58 -0800
From: Chris Steipp <>
Subject: MediaWiki security release - 1.23.7

Hi, we fixed a few security bugs in last week's MediaWiki release [1].
Two of them I think should have CVE's:

* bug 71111 / T73111 - A missing csrf check could allow reflected xss
on wikis that allow raw html

* bug 71478 / T73478 - MediaWiki's <cross-domain-policy> mangling
could allow an article editor to inject code into api consumers that
blindly unserialize php representations of the page from the api

Could those be assigned?

[1] -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.