Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/mediawiki | * | < 1.38.5 | >= 1.38.5 |
MediaWiki is a collaborative editing software, used by big projects like Wikipedia.
Multiple vulnerabilities have been discovered in MediaWiki. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All MediaWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.38.5"
Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/mediawiki | * | < 1.36.1 | >= 1.36.1 |
MediaWiki is a collaborative editing software used by large projects such as Wikipedia.
Multiple vulnerabilities have been discovered in MediaWiki. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All MediaWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.36.1"
Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/mediawiki | * | < 1.25.2 | >= 1.25.2, >= 1.24.3 (revision), >= 1.23.10 (revision) |
MediaWiki is a collaborative editing software used by large projects such as Wikipedia.
Multiple vulnerabilities have been discovered in MediaWiki. Please review the CVE identifiers referenced below for details.
A remote attacker may be able to create a Denial of Service condition, obtain sensitive information, bypass security restrictions, and inject arbitrary web script or HTML.
There is no known workaround at this time.
All MediaWiki 1.25 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.25.2"
All MediaWiki 1.24 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.24.3"
All MediaWiki 1.23 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.23.10"
Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/mediawiki | * | < 1.23.8 | >= 1.23.8, >= 1.22.15 (revision), >= 1.19.23 (revision) |
MediaWiki is a collaborative editing software used by large projects such as Wikipedia.
Multiple vulnerabilities have been discovered in MediaWiki. Please review the CVE identifiers and MediaWiki announcement referenced below for details.
A remote attacker may be able to execute arbitrary code with the privileges of the process, create a Denial of Service condition, obtain sensitive information, bypass security restrictions, and inject arbitrary web script or HTML.
There is no known workaround at this time.
All MediaWiki 1.23 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.23.8"
All MediaWiki 1.22 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.22.15"
All MediaWiki 1.19 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.19.23"
Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/mediawiki | * | < 1.21.2 | >= 1.21.2, >= 1.20.7 (revision), >= 1.19.8 (revision) |
The MediaWiki wiki web application as used on wikipedia.org.
Multiple vulnerabilities have been discovered in MediaWiki. Please review the CVE identifiers referenced below for details.
A remote attacker may be able to execute arbitrary code, perform man-in-the-middle attacks, obtain sensitive information or perform cross-site scripting attacks.
There is no known workaround at this time.
All MediaWiki 1.21.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.21.2"
All MediaWiki 1.20.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.20.7"
All MediaWiki 1.19.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.19.8"
Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/mediawiki | * | < 1.18.2 | >= 1.18.2 |
The MediaWiki wiki web application as used on wikipedia.org.
Multiple vulnerabilities have been discovered in mediawiki. Please review the CVE identifiers referenced below for details.
MediaWiki allows remote attackers to bypass authentication, to perform imports from any wgImportSources wiki via a crafted POST request, to conduct cross-site scripting (XSS) attacks or obtain sensitive information, to inject arbitrary web script or HTML, to conduct clickjacking attacks, to execute arbitrary PHP code, to inject arbitrary web script or HTML, to bypass intended access restrictions and to obtain sensitive information.
There is no known workaround at this time.
All MediaWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.18.2"
MediaWiki is vulnerable to a cross-site scripting attack that could allow arbitrary JavaScript code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/mediawiki | * | < 1.4.15 | >= 1.4.15 |
MediaWiki is a collaborative editing software, used by big projects like Wikipedia.
MediaWiki fails to decode certain encoded URLs correctly.
By supplying specially crafted links, a remote attacker could exploit this vulnerability to inject malicious HTML or JavaScript code that will be executed in a user's browser session in the context of the vulnerable site.
There is no known workaround at this time.
All MediaWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.4.15"
MediaWiki is vulnerable to a cross-site scripting attack that could allow arbitrary JavaScript code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/mediawiki | * | < 1.4.6 | >= 1.4.6 |
MediaWiki is a collaborative editing software, used by big projects like Wikipedia.
MediaWiki fails to escape a parameter in the page move template correctly.
By enticing a user to visit a specially crafted URL, a remote attacker could exploit this vulnerability to inject malicious JavaScript code that will be executed in a user's browser session in the context of the vulnerable site.
There is no known workaround at this time.
All MediaWiki users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.4.7"
MediaWiki is vulnerable to a cross-site scripting attack that could allow arbitrary scripting code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/mediawiki | * | < 1.4.5 | >= 1.4.5, >= 1.3.13 (revision) |
MediaWiki is a collaborative editing software, used by big projects like Wikipedia.
MediaWiki incorrectly handles page template inclusions, rendering it vulnerable to cross-site scripting attacks.
A remote attacker could exploit this vulnerability to inject malicious script code that will be executed in a user's browser session in the context of the vulnerable site.
There is no known workaround at this time.
All MediaWiki users should upgrade to the latest available versions:
# emerge --sync # emerge --ask --oneshot --verbose www-apps/mediawiki
MediaWiki is vulnerable to cross-site scripting, data manipulation and security bypass attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/mediawiki | * | < 1.3.11 | >= 1.3.11 |
MediaWiki is a collaborative editing software, used by big projects like Wikipedia.
A security audit of the MediaWiki project discovered that MediaWiki is vulnerable to several cross-site scripting and cross-site request forgery attacks, and that the image deletion code does not sufficiently sanitize input parameters.
By tricking a user to load a carefully crafted URL, a remote attacker could hijack sessions and authentication cookies to inject malicious script code that will be executed in a user's browser session in context of the vulnerable site, or use JavaScript submitted forms to perform restricted actions. Using the image deletion flaw, it is also possible for authenticated administrators to delete arbitrary files via directory traversal.
There is no known workaround at this time.
All MediaWiki users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.3.11"