UBUNTU-CVE-2014-2242

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2014-2242

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-2242.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2014-2242

Related

CVE-2014-2242

Published

2014-03-02T04:57:00Z

Modified

2025-01-13T10:21:05Z

Summary

[none]

Details

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.

References

Affected packages

Ubuntu:14.04:LTS / mediawiki

Package

Name: mediawiki
Purl: pkg:deb/ubuntu/mediawiki@1:1.19.14+dfsg-1?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:1.19.14+dfsg-1

Affected versions

1:1.*

1:1.19.8+dfsg-1

1:1.19.8+dfsg-2

1:1.19.8+dfsg-2.1

1:1.19.8+dfsg-2.2

1:1.19.9+dfsg-2

1:1.19.10+dfsg-1

1:1.19.11+dfsg-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1:1.19.14+dfsg-1",
            "binary_name": "mediawiki"
        },
        {
            "binary_version": "1:1.19.14+dfsg-1",
            "binary_name": "mediawiki-classes"
        }
    ]
}