Security Information / 2017 / Security Information -- DSA-3870-1 wordpress

Debian Security Advisory

DSA-3870-1 wordpress -- security update

Date Reported:

01 Jun 2017

Affected Packages:

wordpress

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 862053, Bug 862816.
In Mitre's CVE dictionary: CVE-2017-8295, CVE-2017-9061, CVE-2017-9062, CVE-2017-9063, CVE-2017-9064, CVE-2017-9065.

More information:

Several vulnerabilities were discovered in wordpress, a web blogging tool. They would allow remote attackers to force password resets, and perform various cross-site scripting and cross-site request forgery attacks.

For the stable distribution (jessie), these problems have been fixed in version 4.1+dfsg-1+deb8u14.

For the upcoming stable (stretch) and unstable (sid) distributions, these problems have been fixed in version 4.7.5+dfsg-1.

We recommend that you upgrade your wordpress packages.