[Git][security-tracker-team/security-tracker][master] more mediawiki issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9f66428a by Moritz Muehlenhoff at 2025-10-02T21:55:52+02:00
more mediawiki issues

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,25 @@
+CVE-2025-61642 [Escape submit button label for Codex-based HTMLForms]
+	- mediawiki <unfixed>
+	[bookworm] - mediawiki <not-affected> (Vulnerable code not present)
+	[bullseye] - mediawiki <not-affected> (Vulnerable code not present)
+	NOTE: https://phabricator.wikimedia.org/T402313
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1193175
+CVE-2025-61641 [api: Disable maxsize in QueryAllPages in miser mode]
+	- mediawiki <unfixed>
+	NOTE: https://phabricator.wikimedia.org/T298690
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1193174
+CVE-2025-61640 [Parse messages instead of inserting them as HTML]
+	- mediawiki <unfixed>
+	NOTE: https://phabricator.wikimedia.org/T402075
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1193173
+CVE-2025-61639 [Use ManualLogEntry::getDeleted in ::getRecentChange]
+	- mediawiki <unfixed>
+	NOTE: https://phabricator.wikimedia.org/T280413
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1193178
+CVE-2025-61638 [Sanitize data- attributes]
+	- mediawiki <unfixed>
+	NOTE: https://phabricator.wikimedia.org/T401099
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1193172
 CVE-2025-61637 [Escape three system messages used by live preview]
 	- mediawiki <unfixed>
 	[bookworm] - mediawiki <not-affected> (Vulnerable code not present)


=====================================
data/dsa-needed.txt
=====================================
@@ -46,6 +46,8 @@ linux (carnil)
 --
 mbedtls/oldstable
 --
+mediawiki (jmm)
+--
 netty
 --
 opennds/oldstable



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9f66428a9fbab3d9ef532c69aed242d856bd6d39

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9f66428a9fbab3d9ef532c69aed242d856bd6d39
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20251002/35a842fa/attachment-0001.htm>