{"id":"MGASA-2015-0486","summary":"Updated mediawiki packages fix security vulnerabilities","details":"Updated mediawiki packages fix security vulnerabilities:\n\nIn MediaWiki before 1.23.12, an XSS vector exists when MediaWiki is\nconfigured with a non-standard configuration, from wikitext when\n$wgArticlePath='$1' (CVE-2015-8622).\n\nIn MediaWiki before 1.23.12, tokens were being compared as strings, which\ncould allow a timing attack (CVE-2015-8623, CVE-2015-8624).\n\nIn MediaWiki before 1.23.12, parameters passed to the curl library were not\nsanitized, which could cause curl to upload files from the webserver to an\nattacker when POST variable starts with '@' (CVE-2015-8625).\n\nIn MediaWiki before 1.23.12, the password reset token could be shorter than\nthe minimum required password length (CVE-2015-8626).\n\nIn MediaWiki before 1.23.12, blocking IP addresses with zero-padded octets\nresulted in a failure to block the IP address (CVE-2015-8627).\n\nIn MediaWiki before 1.23.12, a combination of Special:MyPage redirects and\npagecounts allows an external site to know the wikipedia login of an user\n(CVE-2015-8628).\n","modified":"2026-04-16T06:25:46.182772267Z","published":"2015-12-24T11:08:20Z","upstream":["CVE-2015-8622","CVE-2015-8623","CVE-2015-8624","CVE-2015-8625","CVE-2015-8626","CVE-2015-8627","CVE-2015-8628"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2015-0486.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=17379"},{"type":"WEB","url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html"},{"type":"WEB","url":"http://openwall.com/lists/oss-security/2015/12/23/7"}],"affected":[{"package":{"name":"mediawiki","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/mediawiki?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.12-1.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2015-0486.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}