CVE-2014-9487 The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External...
CriticalCVSS 9.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to CVE-2014-2053.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mediawiki | = 1.19 | No fix listed |
| mediawiki | = 1.19-beta_1 | No fix listed |
| mediawiki | = 1.19-beta_2 | No fix listed |
| mediawiki | = 1.19.0 | No fix listed |
| mediawiki | = 1.19.1 | No fix listed |
| mediawiki | = 1.19.2 | No fix listed |
| mediawiki | = 1.19.3 | No fix listed |
| mediawiki | = 1.19.4 | No fix listed |
| mediawiki | = 1.19.5 | No fix listed |
| mediawiki | = 1.19.6 | No fix listed |
| mediawiki | = 1.19.7 | No fix listed |
| mediawiki | = 1.19.8 | No fix listed |
| mediawiki | = 1.19.9 | No fix listed |
| mediawiki | = 1.19.10 | No fix listed |
| mediawiki | = 1.19.11 | No fix listed |
| mediawiki | = 1.19.12 | No fix listed |
| mediawiki | = 1.19.13 | No fix listed |
| mediawiki | = 1.19.14 | No fix listed |
| mediawiki | = 1.19.15 | No fix listed |
| mediawiki | = 1.19.16 | No fix listed |
| mediawiki | = 1.19.17 | No fix listed |
| mediawiki | = 1.19.18 | No fix listed |
| mediawiki | = 1.19.19 | No fix listed |
| mediawiki | = 1.19.20 | No fix listed |
| mediawiki | = 1.19.21 | No fix listed |
Show 26 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mediawiki | = 1.19.22 | No fix listed |
| mediawiki | = 1.22.0 | No fix listed |
| mediawiki | = 1.22.0-rc1 | No fix listed |
| mediawiki | = 1.22.1 | No fix listed |
| mediawiki | = 1.22.2 | No fix listed |
| mediawiki | = 1.22.3 | No fix listed |
| mediawiki | = 1.22.4 | No fix listed |
| mediawiki | = 1.22.5 | No fix listed |
| mediawiki | = 1.22.6 | No fix listed |
| mediawiki | = 1.22.7 | No fix listed |
| mediawiki | = 1.22.8 | No fix listed |
| mediawiki | = 1.22.9 | No fix listed |
| mediawiki | = 1.22.10 | No fix listed |
| mediawiki | = 1.22.11 | No fix listed |
| mediawiki | = 1.22.12 | No fix listed |
| mediawiki | = 1.22.13 | No fix listed |
| mediawiki | = 1.22.14 | No fix listed |
| mediawiki | = 1.23.0 | No fix listed |
| mediawiki | = 1.23.1 | No fix listed |
| mediawiki | = 1.23.2 | No fix listed |
| mediawiki | = 1.23.3 | No fix listed |
| mediawiki | = 1.23.4 | No fix listed |
| mediawiki | = 1.23.5 | No fix listed |
| mediawiki | = 1.23.6 | No fix listed |
| mediawiki | = 1.23.7 | No fix listed |
| mediawiki | = 1.24.0 | No fix listed |
References
- [oss-security] 20150103 Re: CVE Request: Mediawiki security releases 1.24.1, 1.23.8, 1.22.15 and 1.19.23 mailing-list third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- [MediaWiki-announce] 20141217 MediaWiki Security and Maintenance Releases: 1.24.1, 1.23.8, 1.22.15 and 1.19.23 mailing-list vendor-advisory
- GLSA-201502-04 third-party-advisory vendor-advisory