Re: CVE request: mediawiki 1.16.3

[Kurt Seifried <kurt () seifried org>]

BTW I submitted this as a bug for fedora:

https://bugzilla.redhat.com/show_bug.cgi?id=695577

My evil(ish) plan is to take over the mediawiki package for fedora and
then EPEL and then all the plugins. muahahaha! =).

-Kurt


On Tue, Apr 12, 2011 at 11:21 PM, Vincent Danen <vdanen () redhat com> wrote:
> Mediawiki 1.16.3 has been released with three noted flaws:
>
> 1) XSS with IE <= 6 due to improper handling of uploaded file names
> 2) CSS validation error in wikitext parser
> 3) transwiki import neglects to perform access control checks
>
> Can CVE names be assigned to these issues?
>
> http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-April/000096.html
>
> Thanks.
>
> --
> Vincent Danen / Red Hat Security Response Team



-- 
Kurt Seifried
kurt () seifried org
skype: 1-703-879-3176