[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 4249-1] mediawiki security update



-------------------------------------------------------------------------
Debian LTS Advisory DLA-4249-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
July 23, 2025                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : mediawiki
Version        : 1:1.35.13-1+deb11u4
CVE ID         : CVE-2025-3469 CVE-2025-6590 CVE-2025-6591 CVE-2025-6593
                 CVE-2025-6594 CVE-2025-6595 CVE-2025-6597 CVE-2025-6926
                 CVE-2025-32072 CVE-2025-32696 CVE-2025-32698 CVE-2025-32699

Multiple security vulnerabilities were found in mediawiki, a website
engine for collaborative work, that could lead to information
disclosure or privilege escalation.

CVE-2025-3469

    User input was not properly sanitized during web page generation,
    which could lead to information disclosure or privilege escalation
    via Cross-site Scripting.

CVE-2025-6590

    User input was not sanitized in the password reset form, which could lead
    to information disclosure for private pages via transclusion.

CVE-2025-6591

    HTML injection in API `action=feedcontributions` output from i18n
    messages.

CVE-2025-6593

    "{{SITENAME}} registered email address has been changed" email was
    sent to unverified email addresses, which could lead to information
    disclosure.

CVE-2025-6594

    XSS in Special:ApiSandbox.  While the known issue is not exploitable
    in ≤1.39, the backported changes provide some security hardening
    just in case.

CVE-2025-6595

    Stored XSS through system messages in MultimediaViewer.

CVE-2025-6597

    Autocreation was treated as login for the purposes of security
    reauthentication.  However it doesn't necessarily involve real-time
    user identification, as it can be based on some provider identifying
    the user based on a session cookie or similar low-fidelity
    information.  An attacker who got hold of a CentralAuth session
    cookie (valid on any wiki) could just visit a wiki where the user
    has no local account yet, get an account autocreated, and then
    change credentials or perform other sensitive operations.

CVE-2025-6926

    Allow extensions to suppress the reauth flag on login.  This is a
    workaround for extensions with some sort of "autologin" implemented
    via the login page to indicate that the login flow didn't involve
    the user actually logging in, it merely copied some central login
    state, and so isn't appropriate for the reauthentication flag.

CVE-2025-32072

    HTML injection in feed output from i18n message.

CVE-2025-32696

     "reupload-own" restriction could be bypassed by reverting file.

CVE-2025-32698

    Improper enforcing of suppression restrictions in LogPager.php.

CVE-2025-32699

    Potential javascript injection attack enabled by Unicode
    normalization in Action API.

For Debian 11 bullseye, these problems have been fixed in version
1:1.35.13-1+deb11u4.

We recommend that you upgrade your mediawiki packages.

For the detailed security status of mediawiki please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mediawiki

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Attachment: signature.asc
Description: PGP signature


Reply to: