oss-sec mailing list archives
CVE Requests: WordPress: 4.5.3 maintenance and security release: several issues
From: Salvatore Bonaccorso <carnil () debian org>
Date: Thu, 23 Jun 2016 19:12:18 +0200
Hi WordPress issued version 4.5.3 a maintenace and security release. The advisory mentions several issues fixed: https://wordpress.org/news/2016/06/wordpress-4-5-3/ WordPress versions 4.5.2 and earlier are affected by several security issues: - redirect bypass in the customizer, reported by Yassine Aboukir; - two different XSS problems via attachment names, reported by Jouko Pynnönen and Divyesh Prajapati; - revision history information disclosure, reported independently by John Blackbourn from the WordPress security team and by Dan Moen from the Wordfence Research Team; - oEmbed denial of service reported by Jennifer Dodd from Automattic; - unauthorized category removal from a post, reported by David Herrera from Alley Interactive; - password change via stolen cookie, reported by Michael Adams from the WordPress security team; - and some less secure sanitize_file_name edge cases reported by Peter Westwood of the WordPress security team. (I wrapped the advisory text in the various separate items). Could you assign CVE identifier as needed for the above issues fixed with the Wordpress 4.5.3 release? Regards, Salvatore
Current thread:
- CVE Requests: WordPress: 4.5.3 maintenance and security release: several issues Salvatore Bonaccorso (Jun 23)