[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Jul 2015 20:14:42 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE request: WordPress 4.2.2 and earlier cross-site scripting
vulnerability
Can I get CVE for WordPress 4.2.2 and earlier cross-site scripting
vulnerability, thanks.
https://wordpress.org/news/2015/07/wordpress-4-2-3/
"""
WordPress 4.2.3 is now available. This is a security release for all previous
versions and we strongly encourage you to update your sites immediately.
WordPress versions 4.2.2 and earlier are affected by a cross-site scripting
vulnerability, which could allow users with the Contributor or Author role to
compromise a site. This was reported by Jon Cave and fixed by Robert Chapin,
both of the WordPress security team.
We also fixed an issue where it was possible for a user with Subscriber
permissions to create a draft through Quick Draft. Reported by Netanel Rubin
from Check Point Software Technologies.
Our thanks to those who have practiced responsible disclosure of security
issues.
WordPress 4.2.3 also contains fixes for 20 bugs from 4.2. For more information,
see the release notes or consult the list of changes.
Download WordPress 4.2.3 or venture over to Dashboard → Updates and simply click
“Update Now.” Sites that support automatic background updates are already
beginning to update to WordPress 4.2.3.
Thanks to everyone who contributed to 4.2.3:
Aaron Jorbin, Andrew Nacin, Andrew Ozz, Boone Gorges, Chris Christoff, Dion
Hulse, Dominik Schilling, Ella Iseulde Van Dorpe, Gabriel Pérez, Gary
Pendergast, Mike Adams, Robert Chapin, Nikolay Bachiyski, Ross Wintle, and Scott
Taylor.
"""
--
Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
