Date: Thu, 23 Jun 2016 14:55:12 -0400 (EDT) From: cve-assign@...re.org To: carnil@...ian.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Requests: WordPress: 4.5.3 maintenance and security release: several issues -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > https://wordpress.org/news/2016/06/wordpress-4-5-3/ > - redirect bypass in the customizer, reported by Yassine Aboukir; Use CVE-2016-5832. > - XSS problem via attachment name reported by Jouko Pynnonen Use CVE-2016-5833. > - XSS problem via attachment name reported by Divyesh Prajapati Use CVE-2016-5834. > - revision history information disclosure, reported independently by > John Blackbourn from the WordPress security team and by Dan Moen from > the Wordfence Research Team; Use CVE-2016-5835 (for both reports). > - oEmbed denial of service reported by Jennifer Dodd from Automattic; Use CVE-2016-5836. > - unauthorized category removal from a post, reported by David Herrera > from Alley Interactive; Use CVE-2016-5837. > - password change via stolen cookie, reported by Michael Adams from the > WordPress security team; Use CVE-2016-5838. > - and some less secure sanitize_file_name edge cases reported by Peter > Westwood of the WordPress security team. Use CVE-2016-5839. - -- CVE Assignment Team M/S M300, 202 Burlington Road, Bedford, MA 01730 USA [ A PGP key is available for encrypted communications at http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJXbDAaAAoJEHb/MwWLVhi2vRsP/1cTw1/gyBFvOVlNRD4gUscp sVM6giF0Zex+dI8/mbpN+MVKaRVQyboyYkmIjsrpm8CkUZP+u04cxcoqcaoUOuSX IFr2IciixkO5oEJo8sBQdWYrkqUkUdUDqpbaVhjWF3R1/TtkPZSuFuSxcDZjSp6k OlRdC9kg325QJ7P6apqatAS2mnOM5N46SciRPZzuXZWBAtFlDYlBUAFmSjZri7cn +Wv5XgLa7Tr4sgDm7SYm4J7Uq5zxm/+iFyVCbIGoTsc9/J1ueSjuqQUNxfTa9exq d69CzHODuv97Uh1RkeaD0vWNRujH0IfiRTi4boC/6t5QyhVUwuIUcFnWt3JMEVL5 Zy72e9BrVCEnEOjmRNVHLtH1g5IE88qZmDMLlmDTS8B+9sR2YzqY4pxVvRSIWiLD GKR7UI0FOQw7L2tMcuVdTUmjDj3szeSVdrbBNqltwFGIWOVoM4YQgMbvMOLmTPUg 1Z1WcHLBbIkUTBExOgreTynbw6qNj07Ke58FJ48HOJokDNZu1OTYS/9DipIJfeuZ Iz6Agxrwe/56RY4Hw0v+t73QDw5NWymRcjUIH5CRXlWaF90lte1+WD+26tqdrOce bUTZCtSVC4p4EaJMVBlTAhHakt/jLNlSGo+E/X1+dyBZIN2gJBM6WgM0SevoFzNq wejdTa3fpDC0Nxv+829x =QXFm -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.