MediaWiki 1.6.9, 1.7.2, 1.8.3, 1.9.0rc2 released (security)

An XSS injection vulnerability was located in the AJAX support module,
affecting MediaWiki 1.6.x and up when the optional setting $wgUseAjax
is enabled.

There is no danger in the default configuration, with $wgUseAjax off.

If you are using an extension based on the optional Ajax module,
either disable it or upgrade to a version containing the fix:

* 1.9: fixed in 1.9.0rc2
* 1.8: fixed in 1.8.3
* 1.7: fixed in 1.7.2
* 1.6: fixed in 1.6.9

Full release notes:
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_9_0RC2/phase3/RELEASE-NOTES
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_8_3/phase3/RELEASE-NOTES
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_7_2/phase3/RELEASE-NOTES
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_9/phase3/RELEASE-NOTES

Download:
http://sourceforge.net/project/showfiles.php?group_id=34373

MD5 checksums:
747d79037d3b90494d7e8b956a6bb9a0  mediawiki-1.9.0rc2.tar.gz
9ef825abfcf0888b22571bbb097480f0  mediawiki-1.8.3.tar.gz
ef33231cb1689dc813f4b08e955f4b18  mediawiki-1.7.2.tar.gz
1ce42061b5f7ea6e4101826b969d2ee4  mediawiki-1.6.9.tar.gz

SHA-1 checksums:
1451e8a8a10f41e517c12ede266dd1a5a743d8fe mediawiki-1.9.0rc2.tar.gz
fa4daa4376b80f61be5925e6172daa76938d9bad mediawiki-1.8.3.tar.gz
f63468ce745bbda6d42f66fc64c713b4fd000ef2 mediawiki-1.7.2.tar.gz
a00bcc6b306a92234da0c2cd3d564869a15045a0 mediawiki-1.6.9.tar.gz

Before asking for help, try the FAQ:
http://www.mediawiki.org/wiki/Manual:FAQ

Low-traffic release announcements mailing list:
(Please subscribe to receive announcements of security updates.)
http://lists.wikimedia.org/mailman/listinfo/mediawiki-announce

Wiki admin help mailing list:
http://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Bug report system:
http://bugzilla.wikimedia.org/

Play "stump the developers" live on IRC:
#mediawiki on irc.freenode.net

-- brion vibber (brion @ pobox.com / brion @ wikimedia.org)