-------------------------------------------------------------------------
Debian LTS Advisory DLA-4249-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Guilhem Moulin
July 23, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : mediawiki
Version : 1:1.35.13-1+deb11u4
CVE ID : CVE-2025-3469 CVE-2025-6590 CVE-2025-6591 CVE-2025-6593
CVE-2025-6594 CVE-2025-6595 CVE-2025-6597 CVE-2025-6926
CVE-2025-32072 CVE-2025-32696 CVE-2025-32698 CVE-2025-32699
Multiple security vulnerabilities were found in mediawiki, a website
engine for collaborative work, that could lead to information
disclosure or privilege escalation.
CVE-2025-3469
User input was not properly sanitized during web page generation,
which could lead to information disclosure or privilege escalation
via Cross-site Scripting.
CVE-2025-6590
User input was not sanitized in the password reset form, which could lead
to information disclosure for private pages via transclusion.
CVE-2025-6591
HTML injection in API `action=feedcontributions` output from i18n
messages.
CVE-2025-6593
"{{SITENAME}} registered email address has been changed" email was
sent to unverified email addresses, which could lead to information
disclosure.
CVE-2025-6594
XSS in Special:ApiSandbox. While the known issue is not exploitable
in ≤1.39, the backported changes provide some security hardening
just in case.
CVE-2025-6595
Stored XSS through system messages in MultimediaViewer.
CVE-2025-6597
Autocreation was treated as login for the purposes of security
reauthentication. However it doesn't necessarily involve real-time
user identification, as it can be based on some provider identifying
the user based on a session cookie or similar low-fidelity
information. An attacker who got hold of a CentralAuth session
cookie (valid on any wiki) could just visit a wiki where the user
has no local account yet, get an account autocreated, and then
change credentials or perform other sensitive operations.
CVE-2025-6926
Allow extensions to suppress the reauth flag on login. This is a
workaround for extensions with some sort of "autologin" implemented
via the login page to indicate that the login flow didn't involve
the user actually logging in, it merely copied some central login
state, and so isn't appropriate for the reauthentication flag.
CVE-2025-32072
HTML injection in feed output from i18n message.
CVE-2025-32696
"reupload-own" restriction could be bypassed by reverting file.
CVE-2025-32698
Improper enforcing of suppression restrictions in LogPager.php.
CVE-2025-32699
Potential javascript injection attack enabled by Unicode
normalization in Action API.
For Debian 11 bullseye, these problems have been fixed in version
1:1.35.13-1+deb11u4.
We recommend that you upgrade your mediawiki packages.
For the detailed security status of mediawiki please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mediawiki
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature