—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:241
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : mediawiki
Date : December 14, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated mediawiki packages fix security vulnerabilies:

In MediaWiki before 1.23.7, a missing CSRF check could allow reflected
XSS on wikis that allow raw HTML (CVE-2014-9276).

MediaWiki's mangling, in MediaWiki before 1.23.7, could
allow an article editor to inject code into API consumers that
blindly unserialize PHP representations of the page from the API
(CVE-2014-9277).

This update provides MediaWiki 1.23.7, which fixes these security
issues and other bugs.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9276
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9277
http://advisories.mageia.org/MGASA-2014-0506.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
0f5bdc4a242be8ca06a40a312b32c7ef mbs1/x86_64/mediawiki-1.23.7-1.mbs1.noarch.rpm
0f47f57785c1aba4ebc8f2eee8357624 mbs1/x86_64/mediawiki-mysql-1.23.7-1.mbs1.noarch.rpm
365f69a5faf3ef56514cdce61d7447d9 mbs1/x86_64/mediawiki-pgsql-1.23.7-1.mbs1.noarch.rpm
cba281c689c5fea48729824c846f7b97 mbs1/x86_64/mediawiki-sqlite-1.23.7-1.mbs1.noarch.rpm
a4030cd00410b812d48db327ebc165a6 mbs1/SRPMS/mediawiki-1.23.7-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUjYsLmqjQ0CJFipgRAkSfAJsEny/nKnGjKgFGK87yZZAOQFPmvACgoY8S
pE8nHuaehD94b8n0wF7MpBI=
=02r3
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________