Date: Wed, 8 Mar 2017 13:19:21 +0000 (UTC) From: Torsten Zuehlsdorff <tz@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r435685 - head/security/vuxml Message-ID: <201703081319.v28DJLMj055675@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tz Date: Wed Mar 8 13:19:21 2017 New Revision: 435685 URL: https://svnweb.freebsd.org/changeset/ports/435685 Log: Document wordpress security issues PR: 217608, 217598 Security: https://vuxml.FreeBSD.org/freebsd/82752070-0349-11e7-b48d-00e04c1ea73d.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed Mar 8 13:09:18 2017 (r435684) +++ head/security/vuxml/vuln.xml Wed Mar 8 13:19:21 2017 (r435685) @@ -58,6 +58,49 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="82752070-0349-11e7-b48d-00e04c1ea73d"> + <topic>wordpress -- multiple vulnerabilities</topic> + <affects> + <package> + <name>wordpress</name> + <range><lt>4.7.3,1</lt></range> + </package> + <package> + <name>de-wordpress</name> + <name>ja-wordpress</name> + <name>ru-wordpress</name> + <name>zh-wordpress-zh_CN</name> + <name>zh-wordpress-zh_TW</name> + <range><lt>4.7.3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <blockquote cite="https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/">; + <p>WordPress versions 4.7.2 and earlier are affected by six security issues.</p> + <ul> + <li>Cross-site scripting (XSS) via media file metadata.</li> + <li>Control characters can trick redirect URL validation.</li> + <li>Unintended files can be deleted by administrators using the + plugin deletion functionality.</li> + <li>Cross-site scripting (XSS) via video URL in YouTube embeds.</li> + <li>Cross-site scripting (XSS) via taxonomy term names.</li> + <li>Cross-site request forgery (CSRF) in Press This leading to + excessive use of server resources.</li> + </ul> + </blockquote> + </body> + </description> + <references> + <url>http://www.openwall.com/lists/oss-security/2017/03/07/3</url>; + <url>https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/</url>; + </references> + <dates> + <discovery>2017-03-07</discovery> + <entry>2017-03-07</entry> + </dates> + </vuln> + <vuln vid="96eca031-1313-4daf-9be2-9d6e1c4f1eb5"> <topic>mozilla -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201703081319.v28DJLMj055675>