SB2019112025 - Multiple vulnerabilities in MediaWiki MediaWiki

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2013-1816)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.

2) Information disclosure (CVE-ID: CVE-2013-1817)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.

Remediation

Install update from vendor's website.

References

• http://security.gentoo.org/glsa/glsa-201310-21.xml
• http://www.openwall.com/lists/oss-security/2013/03/05/4
• http://www.securityfocus.com/bid/58306
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1816
• https://exchange.xforce.ibmcloud.com/vulnerabilities/88360
• https://security-tracker.debian.org/tracker/CVE-2013-1816
• http://www.securityfocus.com/bid/58305
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1817
• https://exchange.xforce.ibmcloud.com/vulnerabilities/88359
• https://security-tracker.debian.org/tracker/CVE-2013-1817