[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 633-1] wordpress security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package        : wordpress
Version        : 3.6.1+dfsg-1~deb7u12
CVE ID         : CVE-2015-8834 CVE-2016-4029 CVE-2016-5836
                 CVE-2016-6634 CVE-2016-6635 CVE-2016-7168
                 CVE-2016-7169

Several vulnerabilities were discovered in wordpress, a web blogging
tool. The Common Vulnerabilities and Exposures project identifies the
following issues.

CVE-2015-8834:
    Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in
    WordPress before 4.2.2 allows remote attackers to inject arbitrary
    web script or HTML via a long comment that is improperly stored
    because of limitations on the MySQL TEXT data type.
    NOTE: this vulnerability exists because of an incomplete fix for
    CVE-2015-3440

CVE-2016-4029:
    WordPress before 4.5 does not consider octal and hexadecimal IP
    address formats when determining an intranet address, which allows
    remote attackers to bypass an intended SSRF protection mechanism
    via a crafted address.

CVE-2016-5836:
    The oEmbed protocol implementation in WordPress before 4.5.3 allows
    remote attackers to cause a denial of service via unspecified
    vectors.

CVE-2016-6634:
    Cross-site scripting (XSS) vulnerability in the network settings
    page in WordPress before 4.5 allows remote attackers to inject
    arbitrary web script or HTML via unspecified vectors.

CVE-2016-6635:
    Cross-site request forgery (CSRF) vulnerability in the
    wp_ajax_wp_compression_test function in wp-admin/includes/ajax-
    actions.php in WordPress before 4.5 allows remote attackers to
    hijack the authentication of administrators for requests that
    change the script compression option.

CVE-2016-7168:
    Fix a cross-site scripting vulnerability via image filename.

CVE-2016-7169:
    Fix a path traversal vulnerability in the upgrade package uploader.

For Debian 7 "Wheezy", these problems have been fixed in version
3.6.1+dfsg-1~deb7u12.

We recommend that you upgrade your wordpress packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQJ8BAEBCgBmBQJX5DsdXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRBQ0YzRDA4OEVGMzJFREVGNkExQTgzNUZE
OUFEMTRCOTUxM0I1MUU0AAoJENmtFLlRO1HkkCAP/1shRRzk6TXl6VLlhw4n/Rhj
Bc986IDqD/y0t+K0Fp4kZ+sOpYFPtt1IpHIAlexBLIMfVmI5Ij0pM4qpHiTlnikI
mFGWzrq5QGRTM3SmbLU2MUXb7USMIkth4ZwB2pPOHNW7UVpshHrsAnxUqveCWsAE
QIM1/cui5M4e07Mz9DsP0pdzzJnxMm1/CmrcT3ME+awYw6gtT+fOg7nqim0QHUDK
wexkiao4wMgkCDzBjZGOxz22F3JBvpPh+VBxgmFMMKWspxp3kUAs9g7hM60rsrrA
UPlfljzT5eJnHTvPpUzvkK03R/I7RUdOuC9TiGb5N5vm+619NNnq4se8KD/a03m6
E11owLslqRF5Wq88TnkrwOawTCPolRom0V4Bz8Tiwvlks4GGSwzwjlUg8TfNokRT
qM2DlUhPMRO4sYY5Hg028hNzhhzMf+TLJ4ajmaFYGeoD7dtcKFl2PHLlJgT+eTOY
VdgKIMAmwTckfdaDlAg+N/8h5PpsK+jZdC0GNzkwP63MNMSkeKXnpmfvrvguI4Ay
iis8oPmYm5fZHKyb5K09Q9cuc58yz9HxAMqn82EuvXhHmLH1e5TIGYtJ4xUZabu/
Oikv3RHFrEHkPlA+oETbG/sIqNA08/BaUB2R/QZHQ72m5uUjYz/7NzKhwt3MWnKi
6dolQw50Se6s/nTDxzZy
=FmfX
-----END PGP SIGNATURE-----


Reply to: