Mediawiki SVG File Handling Security Bypass Vulnerability

Bugtraq ID:	70153
Class:	Design Error
CVE:	CVE-2014-7199
Remote:	Yes
Local:	No
Published:	Sep 25 2014 12:00AM
Updated:	Apr 13 2015 10:14PM
Credit:	The vendor reported this issue.
Vulnerable:	MediaWiki Mediawiki 1.23.2 MediaWiki Mediawiki 1.23.1 MediaWiki Mediawiki 1.23 MediaWiki Mediawiki 1.22.9 MediaWiki Mediawiki 1.22.8 MediaWiki Mediawiki 1.22.7 MediaWiki Mediawiki 1.22.6 MediaWiki Mediawiki 1.19.18 MediaWiki Mediawiki 1.19.17 MediaWiki Mediawiki 1.19.16 MediaWiki Mediawiki 1.19.15 MediaWiki Mediawiki 1.19.10 MediaWiki Mediawiki 1.19.9 MediaWiki Mediawiki 1.19.8 MediaWiki Mediawiki 1.19.7 MediaWiki Mediawiki 1.19.6 MediaWiki Mediawiki 1.19.5 MediaWiki Mediawiki 1.19.4 MediaWiki Mediawiki 1.19.3 MediaWiki Mediawiki 1.19.2 MediaWiki Mediawiki 1.19.1 MediaWiki Mediawiki 1.19 MediaWiki Mediawiki 1.22.5 MediaWiki Mediawiki 1.22.4 MediaWiki Mediawiki 1.22.3 MediaWiki Mediawiki 1.22.2 MediaWiki Mediawiki 1.22.1 MediaWiki Mediawiki 1.22.0 MediaWiki Mediawiki 1.19.14 MediaWiki Mediawiki 1.19.13 MediaWiki Mediawiki 1.19.12 MediaWiki Mediawiki 1.19.11 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	MediaWiki Mediawiki 1.23.4 MediaWiki Mediawiki 1.22.11 MediaWiki Mediawiki 1.19.19

Mediawiki SVG File Handling Security Bypass Vulnerability

An attacker can exploit this issue using a web browser.

Mediawiki SVG File Handling Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva mediawiki-1.23.4-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva mediawiki-mysql-1.23.4-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva mediawiki-pgsql-1.23.4-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva mediawiki-sqlite-1.23.4-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/

Mediawiki SVG File Handling Security Bypass Vulnerability

References:

• MediaWiki Homepage (MediaWiki)
  
• MediaWiki Security and Maintenance Releases: 1.19.19, 1.22.11 and 1.23.4 (MediaWiki)
  
• Upload should disallow SVGs with third-party content in style elements (not just (MediaWiki)