Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 17 Apr 2012 12:35:07 +0300
From: Henri Salo <>
Cc: Hanno Böck <>,
	Kurt Seifried <>,
	Yves-Alexis Perez <>
Subject: Re: CVE-request: WordPress 3.1.1

I previously requested CVE-identifiers for two WordPress 3.1.1 issues (2011), which are still not assigned.

> 1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Hanno Böck said in that CVE-2012-0287 is for this issue.

Name: CVE-2012-0287
Status: Candidate
Phase: Assigned (20120103)
Reference: MISC:
Reference: CONFIRM:
Reference: SECTRACK:1026542
Reference: URL:

Cross-site scripting (XSS) vulnerability in wp-comments-post.php in
WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows
remote attackers to inject arbitrary web script or HTML via the query
string in a POST operation that is not properly handled by the
"Duplicate comment detected" feature.

Current Votes:
None (candidate not yet proposed)

It seems to be assigned for 3.3.1 and not for 3.1.1. Sorry for my mistake also in last emails.

> 2) The "make_clickable()" function in wp-includes/formatting.php does not properly check the URL length in comments before passing it to the PCRE library, which can be exploited to cause a crash.

Still no CVE.

> I even contacted WordPress administrators and asked if this does have CVE, but they haven't replied for some reason.

Still no answer.

Can we now assign CVE-identifiers for 3.1.1 issues, thanks? List of issues in 3.1.1 can be found from here and related news article in here

- Henri Salo

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.