CVE-2013-6453

Published: 12 May 2014

MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.

Priority

Medium

Status

Package Release Status
mediawiki
Launchpad, Ubuntu, Debian
Upstream
Released (1:1.19.10+dfsg-1)
Ubuntu 16.04 LTS (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was not-affected [1:1.19.11+dfsg-1])
Patches:
Upstream: https://bugzilla.wikimedia.org/attachment.cgi?id=14267 (1.19)
Upstream: https://bugzilla.wikimedia.org/attachment.cgi?id=14268 (1.21)
Upstream: https://bugzilla.wikimedia.org/attachment.cgi?id=14269 (1.22)