{"id":"MGASA-2015-0421","summary":"Updated mediawiki packages fix security vulnerabilities","details":"Updated mediawiki packages fix security vulnerabilities:\n\nIn MediaWiki before 1.23.11, the API failed to correctly stop adding new\nchunks to the upload when the reported size was exceeded, allowing a\nmalicious user to upload add an infinite number of chunks for a single file\nupload (CVE-2015-8001).\n\nIn MediaWiki before 1.23.11, a malicious user could upload chunks of 1 byte\nfor very large files, potentially creating a very large number of files on\nthe server's filesystem (CVE-2015-8002).\n\nIn MediaWiki before 1.23.11, it is not possible to throttle file uploads,\nor in other words, rate limit them (CVE-2015-8003).\n\nIn MediaWiki before 1.23.11, a missing authorization check when removing\nsuppression from a revision allowed users with the 'viewsuppressed' user\nright but not the appropriate 'suppressrevision' user right to unsuppress\nrevisions (CVE-2015-8004).\n\nIn MediaWiki before 1.23.11, thumbnails of PNG files generated with\nImageMagick contained the local file path in the image (CVE-2015-8005).\n","modified":"2026-04-16T06:26:14.079020702Z","published":"2015-11-02T20:21:29Z","upstream":["CVE-2015-8001","CVE-2015-8002","CVE-2015-8003","CVE-2015-8004","CVE-2015-8005"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2015-0421.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=16990"},{"type":"WEB","url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html"},{"type":"WEB","url":"http://openwall.com/lists/oss-security/2015/10/29/14"}],"affected":[{"package":{"name":"mediawiki","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/mediawiki?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.11-1.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2015-0421.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}