CVE-2014-7295

Related Files

Gentoo Linux Security Advisory 201502-04

Posted Feb 9, 2015

Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201502-4 - Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. Versions less than 1.23.8 are affected.

tags | advisory, remote, arbitrary, vulnerability

systems | linux, gentoo

advisories | CVE-2013-6451, CVE-2013-6452, CVE-2013-6453, CVE-2013-6454, CVE-2013-6472, CVE-2014-1610, CVE-2014-2242, CVE-2014-2243, CVE-2014-2244, CVE-2014-2665, CVE-2014-2853, CVE-2014-5241, CVE-2014-5242, CVE-2014-5243, CVE-2014-7199, CVE-2014-7295, CVE-2014-9276, CVE-2014-9277, CVE-2014-9475, CVE-2014-9476, CVE-2014-9477, CVE-2014-9478, CVE-2014-9479, CVE-2014-9480, CVE-2014-9481, CVE-2014-9487, CVE-2014-9507

SHA-256 | 704af9a91a2aea64b538f4720a85bdb013ce9b13608e52b9e5fa6b57e832eefd

Download | Favorite | View

Mandriva Linux Security Advisory 2014-198

Posted Oct 21, 2014

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-198 - MediaWiki before 1.23.4 is vulnerable to cross-site scripting due to JavaScript injection via CSS in uploaded SVG files. MediaWiki before 1.23.5 is vulnerable to cross-site scripting due to JavaScript injection via user-specificed CSS in certain special pages.

tags | advisory, javascript, xss

systems | linux, mandriva

advisories | CVE-2014-7199, CVE-2014-7295

SHA-256 | 203ecd5d429b9db3c2d9984f8a0ecef47d2012f052b9ba15d8080f4757f1211c

Download | Favorite | View

Debian Security Advisory 3046-1

Posted Oct 6, 2014

Authored by Debian | Site debian.org

Debian Linux Security Advisory 3046-1 - It was reported that MediaWiki, a website engine for collaborative work, allowed to load user-created CSS on pages where user-created JavaScript is not allowed. A wiki user could be tricked into performing actions by manipulating the interface from CSS, or JavaScript code being executed from CSS, on security-wise sensitive pages like Special:Preferences and Special:UserLogin. This update removes the separation of CSS and JavaScript module allowance.

tags | advisory, javascript

systems | linux, debian

advisories | CVE-2014-7295

SHA-256 | a8c028bd8f5b773c2db161c0427d597f71d4ffad2009685a807ddd29f797ca7b

Download | Favorite | View