Debian Security Advisory
DLA-2429-1 wordpress -- LTS security update
- Date Reported:
- 03 Nov 2020
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 973562.
In Mitre's CVE dictionary: CVE-2020-28032, CVE-2020-28033, CVE-2020-28034, CVE-2020-28035, CVE-2020-28036, CVE-2020-28037, CVE-2020-28038, CVE-2020-28039, CVE-2020-28040.
- More information:
There were several vulnerabilites reported against wordpress, as follows:
WordPress before 4.7.19 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
WordPress before 4.7.19 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.
WordPress before 4.7.19 allows XSS associated with global variables.
WordPress before 4.7.19 allows attackers to gain privileges via XML-RPC.
wp-includes/class-wp-xmlrpc-server.php in WordPress before 4.7.19 allows attackers to gain privileges by using XML-RPC to comment on a post.
is_blog_installed in wp-includes/functions.php in WordPress before 4.7.19 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).
WordPress before 4.7.19 allows stored XSS via post slugs.
is_protected_meta in wp-includes/meta.php in WordPress before 4.7.19 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
WordPress before 4.7.19 allows CSRF attacks that change a theme's background image.
For Debian 9 stretch, these problems have been fixed in version 4.7.19+dfsg-1+deb9u1.
We recommend that you upgrade your wordpress packages.
For the detailed security status of wordpress please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wordpress
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS