Date: Thu, 23 Jun 2016 19:12:18 +0200 From: Salvatore Bonaccorso <carnil@...ian.org> To: OSS Security Mailinglist <oss-security@...ts.openwall.com> Subject: CVE Requests: WordPress: 4.5.3 maintenance and security release: several issues Hi WordPress issued version 4.5.3 a maintenace and security release. The advisory mentions several issues fixed: https://wordpress.org/news/2016/06/wordpress-4-5-3/ WordPress versions 4.5.2 and earlier are affected by several security issues: - redirect bypass in the customizer, reported by Yassine Aboukir; - two different XSS problems via attachment names, reported by Jouko Pynnönen and Divyesh Prajapati; - revision history information disclosure, reported independently by John Blackbourn from the WordPress security team and by Dan Moen from the Wordfence Research Team; - oEmbed denial of service reported by Jennifer Dodd from Automattic; - unauthorized category removal from a post, reported by David Herrera from Alley Interactive; - password change via stolen cookie, reported by Michael Adams from the WordPress security team; - and some less secure sanitize_file_name edge cases reported by Peter Westwood of the WordPress security team. (I wrapped the advisory text in the various separate items). Could you assign CVE identifier as needed for the above issues fixed with the Wordpress 4.5.3 release? Regards, Salvatore
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ