This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2016-6336 →
DEBIAN-CVE-2016-6336
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intende...
Original description
The description as published by the source.
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.1-1"}]}]
Debian:13
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.1-1"}]}]
Debian:14
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.1-1"}]}]
References
- advisory security-tracker.debian.org