CVE-2015-2937: High severity mediawiki vulnerability
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2937?
CVE-2015-2937 is considered a high severity vulnerability due to its potential to cause denial of service in affected MediaWiki installations.
How does CVE-2015-2937 affect MediaWiki users?
CVE-2015-2937 allows remote attackers to exploit a flaw that leads to quadratic blowup and excessive memory consumption in MediaWiki.
Which versions of MediaWiki are affected by CVE-2015-2937?
CVE-2015-2937 affects MediaWiki versions prior to 1.19.24, 1.23.9, and any 1.24.x version before 1.24.2.
How do I fix CVE-2015-2937?
To mitigate CVE-2015-2937, upgrade to MediaWiki version 1.19.24, 1.23.9, or 1.24.2 or later.
What are the potential consequences of exploiting CVE-2015-2937?
Exploiting CVE-2015-2937 can result in a denial of service, making the MediaWiki site unresponsive and consuming excessive system resources.