Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Sep 2012 22:29:04 +0200
From: Yves-Alexis Perez <corsac@...ian.org>
To: oss-security@...ts.openwall.com
Cc: security@...dpress.org
Subject: Re: CVEs for wordpress 3.4.2 release

On mer., 2012-09-12 at 13:38 +0300, Hanno Boeck wrote:
> I can't find CVEs assigend for the issues fixed in wordpress 3.4.2.
> 
> http://wordpress.org/news/2012/09/wordpress-3-4-2/
> 
> 
> Sadly, the information is quite limited:
> "Version 3.4.2 also fixes a few security issues and contains some
> security hardening. The vulnerabilities included potential privilege
> escalation and a bug that affects multisite installs with untrusted
> users. These issues were discovered and fixed by the WordPress security
> team."
> 
> I suggest assigning two:
> 1. potential privilege escalation
> 2. problem with untrusted users on multisite installations
> unless someone has more information.

It's alway pretty annoying to try to fix CVEs in wordpress releases,
since they are usually allocated just on some release announcement, and
thus identifying specific commits is pretty hard. It'd be nice if
Wordpress security team could be in the loop since the beginning, it
might help a bit later (so adding them to CC: now)

Regards,
-- 
Yves-Alexis

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.