CVE-2014-1610: Input Validation
First published: Thu Jan 30 2014(Updated: )
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MediaWiki | =1.19.0 | |
| MediaWiki | =1.19.1 | |
| MediaWiki | =1.19.2 | |
| MediaWiki | =1.19.3 | |
| MediaWiki | =1.19.4 | |
| MediaWiki | =1.19.5 | |
| MediaWiki | =1.19.6 | |
| MediaWiki | =1.19.7 | |
| MediaWiki | =1.19.8 | |
| MediaWiki | =1.19.9 | |
| MediaWiki | =1.19.10 | |
| MediaWiki | =1.21.1 | |
| MediaWiki | =1.21.2 | |
| MediaWiki | =1.21.3 | |
| MediaWiki | =1.21.4 | |
| MediaWiki | =1.22.0 | |
| MediaWiki | =1.22.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html
- http://osvdb.org/102630
- http://secunia.com/advisories/56695
- http://secunia.com/advisories/57472
- http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html
- http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html
- http://www.debian.org/security/2014/dsa-2891
- http://www.exploit-db.com/exploits/31329/
- http://www.osvdb.org/102631
- http://www.securityfocus.com/bid/65223
- http://www.securitytracker.com/id/1029707
- https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff
- https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff
- https://bugzilla.wikimedia.org/show_bug.cgi?id=60339
- https://gerrit.wikimedia.org/r/#/c/110069/
- https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php
- https://gerrit.wikimedia.org/r/#/c/110215/
Frequently Asked Questions
What is the severity of CVE-2014-1610?
CVE-2014-1610 is considered a critical vulnerability due to its potential to allow remote command execution.
How do I fix CVE-2014-1610?
To fix CVE-2014-1610, you should upgrade MediaWiki to version 1.22.2, 1.21.5, or 1.19.11 or later.
Which versions of MediaWiki are affected by CVE-2014-1610?
CVE-2014-1610 affects MediaWiki versions 1.22.0, 1.22.1, 1.21.0 to 1.21.4, and 1.19.0 to 1.19.10.
What are the potential impacts of CVE-2014-1610?
The potential impacts of CVE-2014-1610 include remote attackers executing arbitrary commands on the server.
Is my MediaWiki installation vulnerable to CVE-2014-1610?
If you are using MediaWiki versions earlier than 1.22.2, 1.21.5, or 1.19.11 with DjVu or PDF support enabled, your installation is vulnerable to CVE-2014-1610.
- agent/type
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/mediawiki
- canonical/mediawiki
- version/mediawiki/1.19.0
- version/mediawiki/1.19.1
- version/mediawiki/1.19.2
- version/mediawiki/1.19.3
- version/mediawiki/1.19.4
- version/mediawiki/1.19.5
- version/mediawiki/1.19.6
- version/mediawiki/1.19.7
- version/mediawiki/1.19.8
- version/mediawiki/1.19.9
- version/mediawiki/1.19.10
- version/mediawiki/1.21.1
- version/mediawiki/1.21.2
- version/mediawiki/1.21.3
- version/mediawiki/1.21.4
- version/mediawiki/1.22.0
- version/mediawiki/1.22.1