diff -u mediawiki-1.11.2/debian/changelog mediawiki-1.11.2/debian/changelog --- mediawiki-1.11.2/debian/changelog +++ mediawiki-1.11.2/debian/changelog @@ -1,3 +1,15 @@ +mediawiki (1:1.11.2-2ubuntu0.3) hardy-security; urgency=low + + * SECURITY UPDATE: Multiple cross-site scripting (XSS) vulnerabilities in + the web-based installer (config/index.php). (LP: #348858) + - CVE-2009-0737 + - debian/patches/CVE-2009-0737.patch + - patch based on Debian patch + - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514547 + - http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-February/000083.html + + -- Andreas Wenning Thu, 26 Mar 2009 09:55:33 +0100 + mediawiki (1:1.11.2-2ubuntu0.2) hardy-security; urgency=low * SECURITY UPDATE: diff -u mediawiki-1.11.2/debian/patches/series mediawiki-1.11.2/debian/patches/series --- mediawiki-1.11.2/debian/patches/series +++ mediawiki-1.11.2/debian/patches/series @@ -1,5 +1,6 @@ CVE-2008-5249_CVE-2008-5250_CVE-2008-5252.patch CVE-2008-4408.patch +CVE-2009-0737.patch texvc_location.patch mimetypes.patch debian_specific_config.patch only in patch2: unchanged: --- mediawiki-1.11.2.orig/debian/patches/CVE-2009-0737.patch +++ mediawiki-1.11.2/debian/patches/CVE-2009-0737.patch @@ -0,0 +1,1637 @@ +Index: mediawiki-1.11.2/config/index.php +=================================================================== +--- mediawiki-1.11.2.orig/config/index.php 2009-03-26 09:37:53.000000000 +0100 ++++ mediawiki-1.11.2/config/index.php 2009-03-26 09:38:49.000000000 +0100 +@@ -72,7 +72,8 @@ + + + +- MediaWiki <?php echo( $wgVersion ); ?> Installation ++ ++ MediaWiki <?php echo htmlspecialchars( $wgVersion ); ?> Installation +