—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:083
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : mediawiki
Date : May 8, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated mediawiki packages fix security vulnerabilities:

Login CSRF issue in MediaWiki before 1.22.5 in Special:ChangePassword,
whereby a user can be logged into an attackers account without being
aware of it, allowing the attacker to track the user’s activity
(CVE-2014-2665).

XSS vulnerability in MediaWiki before 1.22.6, where if the default
sort key is set to a string containing a script, the script will be
executed when the page is viewed using the info action.

MediaWiki has been updated to version 1.22.6, fixing this and other
issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2665
http://advisories.mageia.org/MGASA-2014-0157.html
http://advisories.mageia.org/MGASA-2014-0197.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
292fb98c951c1b2111ad9fe0bb26a6d2 mbs1/x86_64/mediawiki-1.22.6-1.mbs1.noarch.rpm
7b12b37abd00c4f4e9cf3987d1305ffb mbs1/x86_64/mediawiki-mysql-1.22.6-1.mbs1.noarch.rpm
2d7eb5e3fba48833afa4ab7c6d7c7f52 mbs1/x86_64/mediawiki-pgsql-1.22.6-1.mbs1.noarch.rpm
854f21c25837fbabf6e44353606e5ba3 mbs1/x86_64/mediawiki-sqlite-1.22.6-1.mbs1.noarch.rpm
16c61971b495a75a2fbb85c3a3685d76 mbs1/SRPMS/mediawiki-1.22.6-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTa3MXmqjQ0CJFipgRAu+LAJ41wdyfhpLDje3r6vmrZDMAU9adhgCglgT3
praVkE5/9aVQ94iAVTfJso4=
=6R+/
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________