------------------------------------------------------------------------- Debian LTS Advisory DLA-4249-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Guilhem Moulin July 23, 2025 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : mediawiki Version : 1:1.35.13-1+deb11u4 CVE ID : CVE-2025-3469 CVE-2025-6590 CVE-2025-6591 CVE-2025-6593 CVE-2025-6594 CVE-2025-6595 CVE-2025-6597 CVE-2025-6926 CVE-2025-32072 CVE-2025-32696 CVE-2025-32698 CVE-2025-32699 Multiple security vulnerabilities were found in mediawiki, a website engine for collaborative work, that could lead to information disclosure or privilege escalation. CVE-2025-3469 User input was not properly sanitized during web page generation, which could lead to information disclosure or privilege escalation via Cross-site Scripting. CVE-2025-6590 User input was not sanitized in the password reset form, which could lead to information disclosure for private pages via transclusion. CVE-2025-6591 HTML injection in API `action=feedcontributions` output from i18n messages. CVE-2025-6593 "{{SITENAME}} registered email address has been changed" email was sent to unverified email addresses, which could lead to information disclosure. CVE-2025-6594 XSS in Special:ApiSandbox. While the known issue is not exploitable in ≤1.39, the backported changes provide some security hardening just in case. CVE-2025-6595 Stored XSS through system messages in MultimediaViewer. CVE-2025-6597 Autocreation was treated as login for the purposes of security reauthentication. However it doesn't necessarily involve real-time user identification, as it can be based on some provider identifying the user based on a session cookie or similar low-fidelity information. An attacker who got hold of a CentralAuth session cookie (valid on any wiki) could just visit a wiki where the user has no local account yet, get an account autocreated, and then change credentials or perform other sensitive operations. CVE-2025-6926 Allow extensions to suppress the reauth flag on login. This is a workaround for extensions with some sort of "autologin" implemented via the login page to indicate that the login flow didn't involve the user actually logging in, it merely copied some central login state, and so isn't appropriate for the reauthentication flag. CVE-2025-32072 HTML injection in feed output from i18n message. CVE-2025-32696 "reupload-own" restriction could be bypassed by reverting file. CVE-2025-32698 Improper enforcing of suppression restrictions in LogPager.php. CVE-2025-32699 Potential javascript injection attack enabled by Unicode normalization in Action API. For Debian 11 bullseye, these problems have been fixed in version 1:1.35.13-1+deb11u4. We recommend that you upgrade your mediawiki packages. For the detailed security status of mediawiki please refer to its security tracker page at: https://security-tracker.debian.org/tracker/mediawiki Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature