Date: Sat, 25 Jun 2016 23:17:46 +0000 (UTC) From: Jason Unovitch <junovitch@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r417499 - head/security/vuxml Message-ID: <201606252317.u5PNHksw068597@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: junovitch Date: Sat Jun 25 23:17:46 2016 New Revision: 417499 URL: https://svnweb.freebsd.org/changeset/ports/417499 Log: Document Wordpress vulnerabilities fixed in 4.5.3 PR: 210480 [1] PR: 210581 Reported by: Mihail Timofeev <9267096@gmail.com> [1] Security: CVE-2016-5832 Security: CVE-2016-5833 Security: CVE-2016-5834 Security: CVE-2016-5835 Security: CVE-2016-5836 Security: CVE-2016-5837 Security: CVE-2016-5838 Security: CVE-2016-5839 Security: https://vuxml.FreeBSD.org/freebsd/bfcc23b6-3b27-11e6-8e82-002590263bf5.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Jun 25 22:48:41 2016 (r417498) +++ head/security/vuxml/vuln.xml Sat Jun 25 23:17:46 2016 (r417499) @@ -58,6 +58,64 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="bfcc23b6-3b27-11e6-8e82-002590263bf5"> + <topic>wordpress -- multiple vulnerabilities</topic> + <affects> + <package> + <name>wordpress</name> + <range><lt>4.5.3,1</lt></range> + </package> + <package> + <name>de-wordpress</name> + <name>ja-wordpress</name> + <name>ru-wordpress</name> + <name>zh-wordpress-zh_CN</name> + <name>zh-wordpress-zh_TW</name> + <range><lt>4.5.3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Adam Silverstein reports:</p> + <blockquote cite="https://wordpress.org/news/2016/06/wordpress-4-5-3/">; + <p>WordPress 4.5.3 is now available. This is a security release for + all previous versions and we strongly encourage you to update your + sites immediately.</p> + <p>WordPress versions 4.5.2 and earlier are affected by several + security issues: redirect bypass in the customizer, reported by + Yassine Aboukir; two different XSS problems via attachment names, + reported by Jouko Pynnönenand Divyesh Prajapati; revision history + information disclosure, reported independently by John Blackbourn + from the WordPress security team and by Dan Moen from the Wordfence + Research Team; oEmbed denial of service reported by Jennifer Dodd + from Automattic; unauthorized category removal from a post, reported + by David Herrera from Alley Interactive; password change via stolen + cookie, reported by Michael Adams from the WordPress security team; + and some less secure sanitize_file_name edge cases reported by Peter + Westwood of the WordPress security team.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2016-5832</cvename> + <cvename>CVE-2016-5833</cvename> + <cvename>CVE-2016-5834</cvename> + <cvename>CVE-2016-5835</cvename> + <cvename>CVE-2016-5836</cvename> + <cvename>CVE-2016-5837</cvename> + <cvename>CVE-2016-5838</cvename> + <cvename>CVE-2016-5839</cvename> + <freebsdpr>ports/210480</freebsdpr> + <freebsdpr>ports/210581</freebsdpr> + <url>https://wordpress.org/news/2016/06/wordpress-4-5-3/</url>; + <url>http://www.openwall.com/lists/oss-security/2016/06/23/9</url>; + </references> + <dates> + <discovery>2016-06-18</discovery> + <entry>2016-06-25</entry> + </dates> + </vuln> + <vuln vid="66d77c58-3b1d-11e6-8e82-002590263bf5"> <topic>php -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201606252317.u5PNHksw068597>