Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4377

Re: [syscom] [SECURITY] [DSA 3375-1] wordpress security update

Cross-posted to 2 groups.

Show all headers | View raw

lol again

well I guess it *is* Tuesday

On Mon, 19 Oct 2015, Yves-Alexis Perez wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> - -------------------------------------------------------------------------
> Debian Security Advisory DSA-3375-1                   security@debian.org
> https://www.debian.org/security/                        Yves-Alexis Perez
> October 19, 2015                      https://www.debian.org/security/faq
> - -------------------------------------------------------------------------
>
> Package        : wordpress
> CVE ID         : CVE-2015-5714 CVE-2015-5715
> Debian Bug     : 799140
>
> Several vulnerabilities have been fixed in Wordpress, the popular
> blogging engine.
>
> CVE-2015-5714
>
>    A cross-site scripting vulnerability when processing shortcode tags
>    has been discovered.
>
>    The issue has been fixed by not allowing unclosed HTML elements in
>    attributes.
>
> CVE-2015-5715
>
>    A vulnerability has been discovered, allowing users without proper
>    permissions to publish private posts and make them sticky.
>
>    The issue has been fixed in the XMLRPC code of Wordpress by not
>    allowing private posts to be sticky.
>
> Other issue(s)
>
>   A cross-site scripting vulnerability in user list tables has been
>   discovered.
>
>   The issue has been fixed by URL-escaping email addresses in those
>   user lists.
>
> For the oldstable distribution (wheezy), these problems will be fixed
> in later update.
>
> For the stable distribution (jessie), these problems have been fixed in
> version 4.1+dfsg-1+deb8u5.
>
> For the testing distribution (stretch), these problems have been fixed
> in version 4.3.1+dfsg-1.
>
> For the unstable distribution (sid), these problems have been fixed in
> version 4.3.1+dfsg-1.
>
> We recommend that you upgrade your wordpress packages.
>
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
>
> Mailing list: debian-security-announce@lists.debian.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQEcBAEBCgAGBQJWJU/4AAoJEG3bU/KmdcClwJkH+wbyIKtik3ASrpO/TqULYail
> PYwhsEcb58PjFLn5IEqvXXaAi6FANhcllNwennROd5rqNvSZjPNXjkHge+PV64RO
> T1rsT4G1MnM2e9CQvRzT3HQP0JC3u/79IvDkGsUfJjMbG/juBcZH4F69VHD/hN8x
> rg9ChCEkKjAKAgJIfVU95H4N64iYEsbuRA9d6gJTGqfOw6KcSdNgpeQVRUSn1pjV
> ZxabKmG6NFdFaKjo6Ql1FN9yg5bY0u2rNVH7exR+ce19H5N4QY22yqdF5iMNmYb+
> 3F6UgfTjYXV3PYoyPkoYTbdpcopoWQpCjh/dasjyX0yD06O9F2fW4Ht6UUOxbw8=
> =sToZ
> -----END PGP SIGNATURE-----
>
>

Back to linux.debian.security | Previous | Next | Find similar | Unroll thread

Thread

Re: [syscom] [SECURITY] [DSA 3375-1] wordpress security update Peter Barfuss <pbarfuss@csclub.uwaterloo.ca> - 2015-10-20 23:40 +0200

csiph-web