[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2025-61653/mediawiki: Add link to upstream changeset

[Guilhem Moulin (@guilhem)]

Guilhem Moulin pushed to branch master at Debian Security Tracker / security-tracker


Commits:
95c2ff63 by Guilhem Moulin at 2025-10-30T16:21:55+01:00
CVE-2025-61653/mediawiki: Add link to upstream changeset

- - - - -
fdeb093a by Guilhem Moulin at 2025-10-30T16:21:57+01:00
Add note for CVE-2025-61638/mediawiki

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -9552,7 +9552,7 @@ CVE-2025-10653 (An unauthenticated debug port may allow access to the device fil
 CVE-2025-61653 [Add authorizeRead check for extracts endpoint]
 	- mediawiki 1:1.43.5+dfsg-1
 	NOTE: http://phabricator.wikimedia.org/T397577
-	NOTE: http://phabricator.wikimedia.org/T397577
+	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/TextExtracts/+/1193249
 CVE-2025-11173
 	- mediawiki 1:1.43.5+dfsg-1
 	NOTE: https://phabricator.wikimedia.org/T401862
@@ -9837,6 +9837,7 @@ CVE-2025-61638 [Sanitize data- attributes]
 	NOTE: https://phabricator.wikimedia.org/T401099
 	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1193172
 	NOTE: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1193218
+	NOTE: The fix needs changes in embedded parsoid too: https://gerrit.wikimedia.org/r/c/mediawiki/services/parsoid/+/1124903 (v0.16.6)
 CVE-2025-61637 [Escape three system messages used by live preview]
 	- mediawiki 1:1.43.5+dfsg-1
 	[bookworm] - mediawiki <not-affected> (Vulnerable code not present)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/19915cfe10020509832cc5efbb356bc1425417b0...fdeb093a5601b88288430c9126f76c5e870089c4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/19915cfe10020509832cc5efbb356bc1425417b0...fdeb093a5601b88288430c9126f76c5e870089c4
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20251030/16fdf506/attachment.htm>