This update brings mediawiki to version 1.16.2, which is the latest stable release at the moment, but currently also the only supported and recommended release by the mediawiki developer community.

Further changes :

  - some simple wiki management functionality was added :

    - mw-createinstance <path> creates a wiki instance under       <path>, which is autoupgraded upon package updates.

  - any wiki path entered in /etc/mediawiki/instances will     be autoupgraded upon package updates.

  - /var/www/wiki is entered into this list automatically,     but you can remove it if you don't want this instance to     be autoupgraded.

  - opensearch and suggestions are enabled by default

    - several bug fixes (see changelog).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings mediawiki to version 1.16.4, which is the latest stable release at the moment, but currently also the only supported and recommended release by the mediawiki developer community.

Further changes :

  - some simple wiki management functionality was added :

    - mw-createinstance <path> creates a wiki instance under       <path>, which is autoupgraded upon package updates.

  - any wiki path entered in /etc/mediawiki/instances will     be autoupgraded upon package updates.

  - /var/www/wiki is entered into this list automatically,     but you can remove it if you don't want this instance to     be autoupgraded.

  - opensearch and suggestions are enabled by default

    - several bug fixes (see changelog).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several problems have been discovered in MediaWiki, a website engine for collaborative work.

  - CVE-2011-1578 CVE-2011-1587     Masato Kinugawa discovered a cross-site scripting (XSS)     issue, which affects Internet Explorer clients only, and     only version 6 and earlier. Web server configuration     changes are required to fix this issue. Upgrading     MediaWiki will only be sufficient for people who use     Apache with AllowOverride enabled.

  For details of the required configuration changes, see the upstream   announcements.

  - CVE-2011-1579     Wikipedia user Suffusion of Yellow discovered a CSS     validation error in the wikitext parser. This is an XSS     issue for Internet Explorer clients, and a privacy loss     issue for other clients since it allows the embedding of     arbitrary remote images.

  - CVE-2011-1580     MediaWiki developer Happy-Melon discovered that the     transwiki import feature neglected to perform access     control checks on form submission. The transwiki import     feature is disabled by default. If it is enabled, it     allows wiki pages to be copied from a remote wiki listed     in $wgImportSources. The issue means that any user can     trigger such an import to occur.

  - CVE-2011-4360     Alexandre Emsenhuber discovered an issue where page     titles on private wikis could be exposed bypassing     different page ids to index.php. In the case of the user     not having correct permissions, they will now be     redirected to Special:BadTitle.

  - CVE-2011-4361     Tim Starling discovered that action=ajax requests were     dispatched to the relevant function without any read     permission checks being done. This could have led to     data leakage on private wikis.

ID	Name	Product	Family	Published	Updated	Severity
53521	Fedora 15 : mediawiki-1.16.4-57.fc15 (2011-5495)	Nessus	Fedora Local Security Checks	4/22/2011	1/11/2021	medium
53608	Fedora 13 : mediawiki-1.16.4-58.fc13 (2011-5807)	Nessus	Fedora Local Security Checks	5/2/2011	1/11/2021	medium
53609	Fedora 14 : mediawiki-1.16.4-58.fc14 (2011-5812)	Nessus	Fedora Local Security Checks	5/2/2011	1/11/2021	medium
57506	Debian DSA-2366-1 : mediawiki - multiple vulnerabilities	Nessus	Debian Local Security Checks	1/12/2012	1/11/2021	medium
53567	Fedora 15 : mediawiki-1.16.4-58.fc15 (2011-5848)	Nessus	Fedora Local Security Checks	4/27/2011	1/11/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium