MediaWiki contains a clickjacking flaw. The issue is triggered when an attacker displays the target webpage in a iframe embedded in a malicious website. This may allow a context-dependent attacker to trick a user into clicking a malicious button or link, potentially resulting in total account compromise.

Upgrade to version 1.16.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2011-0003 (see also: NVD)
• Secunia Advisory ID: 42810 44424 49649
• ISS X-Force ID: 64476
• VUPEN Advisory: ADV-2011-0017
• Mail List Post: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.html
  http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-January/000093.html
• Vendor Specific News/Changelog Entry: http://security.gentoo.org/glsa/glsa-201206-09.xml
  https://bugzilla.wikimedia.org/show_bug.cgi?id=26561
• Other Advisory URL: http://www.openwall.com/lists/oss-security/2011/01/04/12
  http://www.openwall.com/lists/oss-security/2011/01/04/6

• PleaseStand