Date: Thu, 13 Sep 2012 22:29:04 +0200 From: Yves-Alexis Perez <corsac@...ian.org> To: oss-security@...ts.openwall.com Cc: security@...dpress.org Subject: Re: CVEs for wordpress 3.4.2 release On mer., 2012-09-12 at 13:38 +0300, Hanno Boeck wrote: > I can't find CVEs assigend for the issues fixed in wordpress 3.4.2. > > http://wordpress.org/news/2012/09/wordpress-3-4-2/ > > > Sadly, the information is quite limited: > "Version 3.4.2 also fixes a few security issues and contains some > security hardening. The vulnerabilities included potential privilege > escalation and a bug that affects multisite installs with untrusted > users. These issues were discovered and fixed by the WordPress security > team." > > I suggest assigning two: > 1. potential privilege escalation > 2. problem with untrusted users on multisite installations > unless someone has more information. It's alway pretty annoying to try to fix CVEs in wordpress releases, since they are usually allocated just on some release announcement, and thus identifying specific commits is pretty hard. It'd be nice if Wordpress security team could be in the loop since the beginning, it might help a bit later (so adding them to CC: now) Regards, -- Yves-Alexis Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.