February 2007 - MediaWiki-announce - lists.wikimedia.org

MediaWiki-announce February 2007

mediawiki-announce@lists.wikimedia.org

1 participants
2 discussions

MediaWiki 1.9.3, 1.8.4, 1.7.3, 1.6.10 released

by Brion Vibber

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 February 20, 2007 MediaWiki 1.9.3 is a security and bug-fix update to the Winter 2007 quarterly release. Minor compatibility fixes for IIS and PostgreSQL are included. An XSS injection vulnerability based on Microsoft Internet Explorer's UTF-7 charset autodetection was located in the AJAX support module, affecting MSIE users on MediaWiki 1.6.x and up when the optional setting $wgUseAjax is enabled. If you are using an extension based on the optional Ajax module, either disable it or upgrade to a version containing the fix: * 1.9: fixed in 1.9.3 * 1.8: fixed in 1.8.4 * 1.7: fixed in 1.7.3 * 1.6: fixed in 1.6.10 There is no known danger in the default configuration, with $wgUseAjax off. * (bug 8992) Fix a remaining raw use of REQUEST_URI in history * (bug 8984) Fix a database error in Special:Recentchangeslinked when using the PostgreSQL database. * Add 'charset' to Content-Type headers on various HTTP error responses to forestall additional UTF-7-autodetect XSS issues. PHP sends only 'text/html' by default when the script didn't specify more details, which some inconsiderate browsers consider a license to autodetect the deadly, hard-to-escape UTF-7. This fixes an issue with the Ajax interface error message on MSIE when $wgUseAjax is enabled (not default configuration); this UTF-7 variant on a previously fixed attack vector was discovered by Moshe BA from BugSec: http://www.bugsec.com/articles.php?Security=24 * Trackback responses now specify XML content type Full release notes: http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_9_3/phase3/RELEASE-NOT… Download: http://download.wikimedia.org/mediawiki/1.9/mediawiki-1.9.3.tar.gz Patch against 1.9.2: http://download.wikimedia.org/mediawiki/1.9/mediawiki-1.9.3.patch Downloads, checksums, and GPG signatures for all versions: http://download.wikimedia.org/mediawiki/1.9/ http://download.wikimedia.org/mediawiki/1.8/ http://download.wikimedia.org/mediawiki/1.7/ http://download.wikimedia.org/mediawiki/1.6/ Before asking for help, try the FAQ: http://www.mediawiki.org/wiki/Manual:FAQ Low-traffic release announcements mailing list: (Please subscribe to receive announcements of security updates.) http://lists.wikimedia.org/mailman/listinfo/mediawiki-announce Wiki admin help mailing list: http://lists.wikimedia.org/mailman/listinfo/mediawiki-l Bug report system: http://bugzilla.wikimedia.org/ Play "stump the developers" live on IRC: #mediawiki on irc.freenode.net - -- brion vibber (brion @ pobox.com / brion @ wikimedia.org ) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFF27NDwRnhpk1wk44RAhmmAKCVZNGTidpNmCJUwUs5JA1CIJL3OwCfUsxy uny25mn0vihjgNoDxl2ZDiw= =bvTp -----END PGP SIGNATURE-----

17?years, 3?months

MediaWiki 1.9.2 released

by Brion Vibber

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is a bug-fix update that fixes some installation and other minor issues with the 1.9.1 release as well as a security issue which was introduced in the 1.9 branch. JavaScript code which regenerated the "sortable tables" feature did not properly sanitize input, leading to an HTML injection vulnerability. * (bug 8774) Fix path for GNU FDL rights icon on new installs * (bug 8819) Fix full path disclosure with skins dependencies * (bug 4268) Fixed data-loss bug in compressOld batch text compression affecting pages which had null edits (move, protect, etc) as second edit in a batch group. Isolated and patched by Travis Derouin. * Security fix for sortable tables JavaScript All users of 1.9.x should upgrade. Full release notes: http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_9_2/phase3/RELEASE-NOT… Download: http://download.wikimedia.org/mediawiki/1.9/mediawiki-1.9.2.tar.gz http://download.wikimedia.org/mediawiki/1.9/mediawiki-1.9.2.patch MD5 checksums: c11aa0fd7ac10529606511913649a411 mediawiki-1.9.2.tar.gz b08777601899686bf4e672766ee5e49e mediawiki-1.9.2.patch SHA-1 checksums: 2f63cba903444b0dc6559df29c57d1789c1284d1 mediawiki-1.9.2.tar.gz dcb64452dbe7d7563264e3883c657e70aabaa1ac mediawiki-1.9.2.patch PGP signatures: http://download.wikimedia.org/mediawiki/1.9/mediawiki-1.9.2.tar.gz.sig http://download.wikimedia.org/mediawiki/1.9/mediawiki-1.9.2.patch.sig Before asking for help, try the FAQ: http://www.mediawiki.org/wiki/Manual:FAQ Low-traffic release announcements mailing list: (Please subscribe to receive announcements of security updates.) http://lists.wikimedia.org/mailman/listinfo/mediawiki-announce Wiki admin help mailing list: http://lists.wikimedia.org/mailman/listinfo/mediawiki-l Bug report system: http://bugzilla.wikimedia.org/ Play "stump the developers" live on IRC: #mediawiki on irc.freenode.net - -- brion vibber (brion @ pobox.com / brion @ wikimedia.org ) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFxm/1wRnhpk1wk44RAkIgAKCZcw0n3eDiadhJWVOhdozYushdvACgkncP BE30fPhajW8upgXvMfjP2/w= =0qZv -----END PGP SIGNATURE-----

17?years, 3?months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

MediaWiki-announce February 2007