{"id":"MGASA-2014-0124","summary":"Updated mediawiki packages fix multiple vulnerabilities","details":"Updated mediawiki packages fix security vulnerabilities:\n\nMediaWiki before 1.22.3 does not block unsafe namespaces, such as a W3C XHTML\nnamespace, in uploaded SVG files.  Some client software may use these\nnamespaces in a way that results in XSS.  This was fixed by disallowing\nuploading SVG files using non-whitelisted namespaces (CVE-2014-2242).\n\nMediaWiki before 1.22.3 performs token comparison that may be vulnerable to\ntiming attacks.  This was fixed by making token comparison use constant time\n(CVE-2014-2243).\n\nMediaWiki before 1.22.3 could allow an attacker to perform XSS attacks, due\nto flaw with link handling in api.php.  This was fixed such that it won't\nfind links in the middle of api.php links (CVE-2014-2244).\n","modified":"2026-04-16T06:22:33.293251740Z","published":"2014-03-07T20:12:00Z","upstream":["CVE-2014-2242","CVE-2014-2243","CVE-2014-2244"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2014-0124.html"},{"type":"WEB","url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html"},{"type":"WEB","url":"http://openwall.com/lists/oss-security/2014/03/01/2"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=12931"}],"affected":[{"package":{"name":"mediawiki","ecosystem":"Mageia:3","purl":"pkg:rpm/mageia/mediawiki?arch=source&distro=mageia-3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.mga3"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0124.json"}},{"package":{"name":"mediawiki","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/mediawiki?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0124.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}