kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document Wordpress security issues in 4.7.1.

Browse source 
PR:		216540
PR:		216515
Reported by:	Jochen Neumeister <joneum@bsdproject.de>
Reported by:	Mikhail Timofeev <9267096@gmail.com>
Security:	CVE-2017-5610
Security:	CVE-2017-5611
Security:	CVE-2017-5612
Security:	https://vuxml.FreeBSD.org/freebsd/14ea4458-e5cd-11e6-b56d-38d547003487.html
This commit is contained in:
Ben Woods 2017-01-29 03:13:21 +00:00
parent e64236845c
commit 518559d928
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=432696
1 changed files with 48 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
security/vuxml/vuln.xml
View file

@ -58,6 +58,54 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="14ea4458-e5cd-11e6-b56d-38d547003487">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.7.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron D. Campbell reports:</p>
<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/">
<p>WordPress versions 4.7.1 and earlier are affected by three security
issues:</p>
<ul>
<li>The user interface for assigning taxonomy terms in Press This is
shown to users who do not have permissions to use it.</li>
<li>WP_Query is vulnerable to a SQL injection (SQLi) when passing
unsafe data. WordPress core is not directly vulnerable to this
issue, but we’ve added hardening to prevent plugins and
themes from accidentally causing a vulnerability.</li>
<li>A cross-site scripting (XSS) vulnerability was discovered in the
posts list table.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5610</cvename>
<cvename>CVE-2017-5611</cvename>
<cvename>CVE-2017-5612</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/28/5</url>
<url>https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/</url>
</references>
<dates>
<discovery>2017-01-26</discovery>
<entry>2017-01-29</entry>
</dates>
</vuln>
<vuln vid="6e83b2f3-e4e3-11e6-9ac1-a4badb2f4699">
<topic>nfsen -- remote command execution</topic>
<affects>