Debian Mediawiki vulnerabilities

CVE-2025-67479 [NONE] CVE-2025-67479: mediawiki - Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This... Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Cite: from * before 1.39.14, 1.43.4, 1.44.1. Scope: local bookworm: resolved (fixed in 1:1.39.17-

CVE-2025-61637 [NONE] CVE-2025-61637: mediawiki - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site ... Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1

CVE-2025-61636 [NONE] CVE-2025-61636: mediawiki - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site ... Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. Scope: local bookworm: resolved bullseye: resolved forky:

CVE-2007-4828 [MEDIUM] CVE-2007-4828: mediawiki - Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in Medi... Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Scope: local bookworm: resolved (fixed in 1.10.2-1) bullseye: resolved (fixed i

CVE-2013-6452 [MEDIUM] CVE-2013-6452: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x befor... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file. Scope: local bookworm: resolved (fixed in 1:1.19.10+dfsg-1) bullseye: resolved (fixed in 1:1.19.10+dfsg-1) forky: resolved (fixed in 1:1.19.10+dfsg-1) sid:

CVE-2005-3166 [MEDIUM] CVE-2005-3166: mediawiki - Unspecified vulnerability in "edit submission handling" for MediaWiki 1.4.x befo... Unspecified vulnerability in "edit submission handling" for MediaWiki 1.4.x before 1.4.10 and 1.3.x before 1.3.16 allows remote attackers to cause a denial of service (corruption of the previous submission) via a crafted URL. Scope: local bookworm: resolved (fixed in 1.4.11-1) bullseye: resolved (fixed in 1.4.11-1) forky: resolved (fixed in 1.4.11-1) sid: resolved

CVE-2005-2396 [MEDIUM] CVE-2005-2396: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki 1.4.6 and earlier allows r... Cross-site scripting (XSS) vulnerability in MediaWiki 1.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the page move template. Scope: local bookworm: resolved (fixed in 1.4.9) bullseye: resolved (fixed in 1.4.9) forky: resolved (fixed in 1.4.9) sid: resolved (fixed in 1.4.9) trixie: resolved (fixed in 1.4.9)

CVE-2025-11173 [NONE] CVE-2025-11173: mediawiki - Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated... Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php. This issue affects OATHAuth: from * before 1.39.14, 1.43.4, 1.44.1. Scope: local bookworm: resolved (fixed in 1:1.39.17-1~deb12u1) bullseye: resolved (fixed in 1:1.35.13-1+deb11u5) forky: resolved (fixed in 1:1.43.5+dfsg-1) sid: resolved

CVE-2025-61640 [NONE] CVE-2025-61640: mediawiki - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site ... Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. Scope: local bookworm: resolved (fixed in 1:1

CVE-2009-4589 [MEDIUM] CVE-2009-4589: mediawiki - Cross-site scripting (XSS) vulnerability in the Special:Block implementation in ... Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter. Scope: local bookworm: resolved (fixed in 1:1.15.0-1.1) bullseye: resolved (fixed in 1:1.15.0-1.1) forky: resolved (fix

CVE-2005-0534 [MEDIUM] CVE-2005-0534: mediawiki - Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.x before 1.... Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allow remote attackers to inject arbitrary web script. Scope: local bookworm: resolved (fixed in 1.4.9) bullseye: resolved (fixed in 1.4.9) forky: resolved (fixed in 1.4.9) sid: resolved (fixed in 1.4.9) trixie: resolved (fixed in 1.4.9)

CVE-2025-32697 [NONE] CVE-2025-32697: mediawiki - Improper Preservation of Permissions vulnerability in Wikimedia Foundation Media... Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/IntroMessageBuilder.Php, includes/Permissions/PermissionManager.Php, includes/Permissions/RestrictionStore.Php. This issue affects MediaWiki: before 1.42.6, 1.43.1. Scope: local bookworm: open bullseye: open fo

CVE-2025-32696 [NONE] CVE-2025-32696: mediawiki - Improper Preservation of Permissions vulnerability in Wikimedia Foundation Media... Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/actions/RevertAction.Php, includes/api/ApiFileRevert.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1. Scope: local bookworm: resolved (fixed in 1:1.39.12-1~deb12u1) bullseye: resolved (fixed in 1:1.35.

CVE-2005-1888 [MEDIUM] CVE-2005-1888: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates. Scope: local bookworm: resolved (fixed in 1.4.9) bullseye: resolved (fixed in 1.4.9) forky: resolved (fixed in 1.4.9) sid: resolved (fixed in 1.4.9) trixie: resolved (fixed in 1.4.9)

CVE-2005-2215 [MEDIUM] CVE-2005-2215: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.x before 1.4.6 ... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.x before 1.4.6 and 1.5 before 1.5beta3 allows remote attackers to inject arbitrary web script or HTML via a parameter in the page move template, a different vulnerability than CVE-2005-1888. Scope: local bookworm: resolved (fixed in 1.4.9) bullseye: resolved (fixed in 1.4.9) forky: resolved (fixed in

CVE-2005-1245 [MEDIUM] CVE-2005-1245: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.2, when using H... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.2, when using HTML Tidy ($wgUseTidy), allows remote attackers to inject arbitrary web script or HTML via unknown vectors. Scope: local bookworm: resolved (fixed in 1.4.9) bullseye: resolved (fixed in 1.4.9) forky: resolved (fixed in 1.4.9) sid: resolved (fixed in 1.4.9) trixie: resolved (fixed in 1.4

CVE-2004-2152 [MEDIUM] CVE-2004-2152: mediawiki - Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki... Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML. Scope: local bookworm: resolved (fixed in 1.4.9) bullseye: resolved (fixed in 1.4.9) forky: resolved (fixed in 1.4.9) sid: resolved (fixed in 1.4.9) trixie: resolved (fixed in 1.4.9)

CVE-2010-1647 [MEDIUM] CVE-2010-1647: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.1... Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer. Scope: local bookworm: resolved (fixed in 1:1.15.4-1) bullseye: resolved (fixed in 1:1.15.4-1) forky:

CVE-2014-2665 [MEDIUM] CVE-2014-2665: mediawiki - includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x ... includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demo

CVE-2015-8001 [LOW] CVE-2015-8001: mediawiki - The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.... The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size. Scope: local bookworm: resolved (fixed in 1:1.25.5-1) bullseye: resolved (fixed in 1:1.