drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in wordpress
Name: |
Mehrere Probleme in wordpress |
|
ID: |
DSA-2757-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian sid, Debian squeeze, Debian wheezy, Debian jessie |
|
Datum: |
So, 15. September 2013, 09:25 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4338
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4339
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4340
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5738
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5739 |
|
Applikationen: |
wordpress |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-2757-1 security@debian.org http://www.debian.org/security/ Yves-Alexis Perez September 14, 2013 http://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : wordpress Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2013-4338 CVE-2013-4339 CVE-2013-4340 CVE-2013-5738 CVE-2013-5739 Debian Bug : 722537
Several vulnerabilities were identified in Wordpress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the Wordpress package to the latest upstream version instead of backporting the patches.
This means extra care should be taken when upgrading, especially when using third-party plugins or themes, since compatibility may have been impacted along the way. We recommend that users check their install before doing the upgrade.
CVE-2013-4338
Unsafe PHP unserialization in wp-includes/functions.php could cause arbitrary code execution.
CVE-2013-4339
Insufficient input validation could result in redirecting or leading a user to another website.
CVE-2013-4340
Privilege escalation allowing an user with an author role to create an entry appearing as written by another user.
CVE-2013-5738
Insufficient capabilities were required for uploading .html/.html files, making it easier for authenticated users to conduct cross-site scripting attacks (XSS) using crafted html file uploads.
CVE-2013-5739
Default Wordpress configuration allowed file upload for .swf/.exe files, making it easier for authenticated users to conduct cross-site scripting attacks (XSS).
For the oldstable distribution (squeeze), these problems have been fixed in version 3.6.1+dfsg-1~deb6u1.
For the stable distribution (wheezy), these problems have been fixed in version 3.6.1+dfsg-1~deb7u1.
For the testing distribution (jessie), these problems have been fixed in version 3.6.1+dfsg-1.
For the unstable distribution (sid), these problems have been fixed in version 3.6.1+dfsg-1.
We recommend that you upgrade your wordpress packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.21 (GNU/Linux)
iQEcBAEBCgAGBQJSNCi5AAoJEG3bU/KmdcCl3mgH/0jQvSeOoHHastL2/ELArLoh ZZs99SSj7fqU3DC36EyEW0m+Pe81OlML793RlRxjAcYgv2VxIvFgFuUpMUZ+y1eC ZnJgxyI6mU6qrZ+2sCRp72Rp+6M9X2Hp8wkfgozrBIYhaQikeJTpy/Z9LZmUnQXh pdTqNCIBHfXfUcXxkHT002RuRdK9m4ROI7sh7qMFJfS1YoKM+dW9ys0mPIXQ07Qd kZjDOb7Arn7c5QxcpEEJTgVYettJyXvupll4JkhLPvePYTkYnE4scn3P58GfGNAp PXLi1c4ed9/KZIOSLWE0qmXARjIBvw28Etc1vudX5pFNvEJQmboSfomZzy8t7VE= =gyM6 -----END PGP SIGNATURE-----
-- To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org Archive: http://lists.debian.org/20130914091333.GA14774@scapa.corsac.net
|
|
|
|