[IT-SecNots] [MediaWiki-announce] MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11

[Chris Steipp <csteipp AT wikimedia.org>]

I would like to announce the release of MediaWiki 1.22.2, 1.21.5 and
1.19.11.

Your MediaWiki installation is affected by a remote code execution
vulnerability if you have enabled file upload support for DjVu (natively
supported by MediaWiki) or PDF files (in combination with the PdfHandler
extension). Neither file type is enabled by default in MediaWiki
installations. If you are affected, we strongly urge you to update
immediately.

Affected supported versions: All

== Security fixes ==

* Netanel Rubin from Check Point discovered a remote code execution
vulnerability in MediaWiki's thumbnail generation for DjVu files. Internal
review also discovered similar logic in the PdfHandler extension, which
could be exploited in a similar way. (CVE-2014-1610)
<https://bugzilla.wikimedia.org/show_bug.cgi?id=60339>

== Bug Fixes in 1.22.2 ==
* (bug 58253) Check for very old PCRE versions in installer and updater
* (bug 60054) Make WikiPage::$mPreparedEdit public


Full release notes for 1.22.1:
<https://www.mediawiki.org/wiki/Release_notes/1.22>

Full release notes for 1.21.4:
<https://www.mediawiki.org/wiki/Release_notes/1.21>

Full release notes for 1.19.9:
<https://www.mediawiki.org/wiki/Release_notes/1.19>

For information about how to upgrade, see
<https://www.mediawiki.org/wiki/Manual:Upgrading>


**********************************************************************
   1.22.2
**********************************************************************
Download:
http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.tar.gz

Patch to previous version (1.22.1):
http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.patch.gz

GPG signatures:
http://download.wikimedia.org/mediawiki/1.22/mediawiki-core-1.22.2.tar.gz.sig
http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.tar.gz.sig
http://download.wikimedia.org/mediawiki/1.22/mediawiki-1.22.2.patch.gz.sig
http://download.wikimedia.org/mediawiki/1.22/mediawiki-i18n-1.22.2.patch.gz.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
   1.21.5
**********************************************************************
Download:
http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.tar.gz

Patch to previous version (1.21.4):
http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.patch.gz

GPG signatures:
http://download.wikimedia.org/mediawiki/1.21/mediawiki-core-1.21.5.tar.gz.sig
http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.tar.gz.sig
http://download.wikimedia.org/mediawiki/1.21/mediawiki-1.21.5.patch.gz.sig
http://download.wikimedia.org/mediawiki/1.21/mediawiki-i18n-1.21.5.patch.gz.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
   1.19.11
**********************************************************************
Download:
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.tar.gz

Patch to previous version (1.19.10):
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.patch.gz

GPG signatures:
http://download.wikimedia.org/mediawiki/1.19/mediawiki-core-1.19.11.tar.gz.sig
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.tar.gz.sig
http://download.wikimedia.org/mediawiki/1.19/mediawiki-1.19.11.patch.gz.sig
http://download.wikimedia.org/mediawiki/1.19/mediawiki-i18n-1.19.11.patch.gz.sig

Public keys:
https://www.mediawiki.org/keys/keys.html

**********************************************************************
   Extension:PdfHandler
**********************************************************************
Information and Download:
https://www.mediawiki.org/wiki/Extension:PdfHandler
_______________________________________________
MediaWiki announcements mailing list
To unsubscribe, go to:
https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce