diff options
| author | tron <tron> | 2010-05-29 08:26:39 +0000 |
|---|---|---|
| committer | tron <tron> | 2010-05-29 08:26:39 +0000 |
| commit | 57bed03f03b028f036345ae52c894f83d937fd49 (patch) | |
| tree | 2c06806fc4ea956462389e5f113fbea7de2e63dd | |
| parent | ecf21268661493288342233273ad8add8349d39b (diff) | |
| download | pkgsrc-57bed03f03b028f036345ae52c894f83d937fd49.tar.gz | |
Pullup ticket #3130 - requested by martti
www/mediawiki: security update
Revisions pulled up:
- www/mediawiki/Makefile 1.12
- www/mediawiki/distinfo 1.8
---
Module Name: pkgsrc
Committed By: martti
Date: Fri May 28 08:11:32 UTC 2010
Modified Files:
pkgsrc/www/mediawiki: Makefile distinfo
Log Message:
Updated www/mediawiki to 1.15.4
This is a security and bugfix release of MediaWiki 1.15.4.
Two security vulnerabilities were discovered.
Kuriaki Takashi discovered an XSS vulnerability in MediaWiki. It
affects Internet Explorer clients only. The issue is presumed to
affect all recent versions of IE, it has been confirmed on IE 6 and 8.
Noncompliant CSS parsing behaviour in Internet Explorer allows
attackers to construct CSS strings which are treated as safe by
previous versions of MediaWiki, but are decoded to unsafe strings by
Internet Explorer. Full details can be found at:
https://bugzilla.wikimedia.org/show_bug.cgi?id=23687
A CSRF vulnerability was discovered in our login interface. Although
regular logins are protected as of 1.15.3, it was discovered that the
account creation and password reset features were not protected from
CSRF. This could lead to unauthorised access to private wikis. See
https://bugzilla.wikimedia.org/show_bug.cgi?id=23371 for details.
These vulnerabilities are serious and all users are advised to
upgrade. Remember that CSRF and XSS vulnerabilities can be used even
against firewall-protected intranet installations, as long as the
attacker can guess the URL.
| -rw-r--r-- | www/mediawiki/Makefile | 4 | ||||
| -rw-r--r-- | www/mediawiki/distinfo | 8 |
2 files changed, 6 insertions, 6 deletions
diff --git a/www/mediawiki/Makefile b/www/mediawiki/Makefile index bc4bd1b642a..bf5b8b12eb1 100644 --- a/www/mediawiki/Makefile +++ b/www/mediawiki/Makefile @@ -1,4 +1,4 @@ -# $NetBSD: Makefile,v 1.11 2010/04/07 05:40:11 martti Exp $ +# $NetBSD: Makefile,v 1.11.2.1 2010/05/29 08:26:39 tron Exp $ DISTNAME= mediawiki-${VER}.${PVER} CATEGORIES= www @@ -20,7 +20,7 @@ INSTALLATION_DIRS= ${EGDIR} share/mediawiki PKG_INSTALLATION_TYPES= overwrite pkgviews VER= 1.15 -PVER= 3 +PVER= 4 APACHE_USER?= www APACHE_GROUP?= www diff --git a/www/mediawiki/distinfo b/www/mediawiki/distinfo index f684562909c..9f8ab1284bb 100644 --- a/www/mediawiki/distinfo +++ b/www/mediawiki/distinfo @@ -1,5 +1,5 @@ -$NetBSD: distinfo,v 1.7 2010/04/07 05:40:11 martti Exp $ +$NetBSD: distinfo,v 1.7.2.1 2010/05/29 08:26:40 tron Exp $ -SHA1 (mediawiki-1.15.3.tar.gz) = 891bf5fb7479c88fbb4fd155666eafe510b2f92c -RMD160 (mediawiki-1.15.3.tar.gz) = 77e2d446672ab11832b2f913624d3358a3855651 -Size (mediawiki-1.15.3.tar.gz) = 11486661 bytes +SHA1 (mediawiki-1.15.4.tar.gz) = c00267663a0a05ace4bd28b53b0b3b0f08dad551 +RMD160 (mediawiki-1.15.4.tar.gz) = f4879c0f9cb1b8a6f5682f9fad14010703d49c27 +Size (mediawiki-1.15.4.tar.gz) = 11531488 bytes |