Cloudanix VulnDB

CVE-2014-1610

None

CVSS

—

EPSS

42.8%

Published

Jan 30, 2014

CISA due date

—

The record

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 mediawiki 0 1:1.19.11+dfsg-1
Debian:12 mediawiki 0 1:1.19.11+dfsg-1
Debian:13 mediawiki 0 1:1.19.11+dfsg-1
Debian:7 mediawiki 0 1:1.19.14+dfsg-0+deb7u1
Debian:7 mediawiki-extensions 0 3.5~deb7u1
Mageia:3 mediawiki 0 1.22.2-1.1.mga3
Mageia:3 mediawiki-ldapauthentication 0 2.0f-1.1.mga3
Mageia:3 mediawiki-math 0 1.1-1.1.mga3
Mageia:4 mediawiki 0 1.22.2-1.1.mga4
Mageia:4 mediawiki-ldapauthentication 0 2.0f-1.1.mga4
Mageia:4 mediawiki-math 0 1.1-1.1.mga4
Ubuntu:14.04:LTS mediawiki 0 1:1.19.11+dfsg-1

Related vulnerabilities