| |||||||||||||||||||
Fedora alert FEDORA-2013-1774 (wordpress)
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2013-1774 2013-02-01 15:51:59 -------------------------------------------------------------------------------- Name : wordpress Product : Fedora 18 Version : 3.5.1 Release : 1.fc18 URL : http://www.wordpress.org Summary : Blog tool and publishing platform Description : Wordpress is an online publishing / weblog package that makes it very easy, almost trivial, to get information out to people on the web. -------------------------------------------------------------------------------- Update Information: WordPress 3.5.1 is now available. Version 3.5.1 is the first maintenance release of 3.5, fixing 37 bugs. It is also a security release for all previous WordPress versions. Which include: * Editor: Prevent certain HTML elements from being unexpectedly removed or modified in rare cases. * Media: Fix a collection of minor workflow and compatibility issues in the new media manager. * Networks: Suggest proper rewrite rules when creating a new network. * Prevent scheduled posts from being stripped of certain HTML, such as video embeds, when they are published. * Work around some misconfigurations that may have caused some JavaScript in the WordPress admin area to fail. * Suppress some warnings that could occur when a plugin misused the database or user APIs. WordPress 3.5.1 also addresses the following security issues: * A server-side request forgery vulnerability and remote port scanning using pingbacks. This vulnerability, which could potentially be used to expose information and compromise a site, affects all previous WordPress versions. This was fixed by the WordPress security team. We’d like to thank security researchers Gennady Kovshenin and Ryan Dewhurst for reviewing our work. * Two instances of cross-site scripting via shortcodes and post content. These issues were discovered by Jon Cave of the WordPress security team. * A cross-site scripting vulnerability in the external library Plupload. Thanks to the Moxiecode team for working with us on this, and for releasing Plupload 1.5.5 to address this issue. -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 30 2013 Remi Collet <rcollet@redhat.com> - 3.5.1-1 - version 3.5.1, various bug and security fixes: CVE-2013-0235, CVE-2013-0236 and CVE-2013-0237 - drop -f option from rm to break build if upstream archive content change - protect akismet content (from upstream .htaccess) * Wed Jan 2 2013 Remi Collet <rcollet@redhat.com> - 3.5-3 - fix links to system PHPMailer library * Sun Dec 16 2012 Remi Collet <rcollet@redhat.com> - 3.5-2 - fix use of system Simplepie - give access from local (httpd 2.4) * Wed Dec 12 2012 Matěj Cepl <mcepl@redhat.com> - 3.5-1 - New upstream release. * Tue Dec 4 2012 Matěj Cepl <mcepl@redhat.com> - 3.5-0.5.RC3 - New upstream release candidate. * Fri Nov 30 2012 Matěj Cepl <mcepl@redhat.com> - 3.5-0.5.RC2 - New upstream release candidate. * Sat Nov 24 2012 Matěj Cepl <mcepl@redhat.com> - 3.5-0.5.RC1 - New upstream release candidate. * Tue Nov 13 2012 Matěj Cepl <mcepl@redhat.com> - 3.5-0.4.beta3 - New upstream beta3 version * Mon Oct 29 2012 Remi Collet <rcollet@redhat.com> - 3.5-0.3.beta2 - use system PHPMailer - requires needed php extensions * Sat Oct 13 2012 Matěj Cepl <mcepl@redhat.com> - 3.5-0.2.beta2 - New upstream beta2 version * Thu Oct 4 2012 Matěj Cepl <mcepl@redhat.com> - 3.5-0.2.beta1 - New upstream beta1 version - Don’t even bother with removing gettext.php ... it is not used anymore -------------------------------------------------------------------------------- References: [ 1 ] Bug #904120 - CVE-2013-0235 wordpress: Server-side request forgery and remote port scanning using pingbacks https://bugzilla.redhat.com/show_bug.cgi?id=904120 [ 2 ] Bug #904121 - wordpress: XSS flaws via shortcodes and HTTP POST content https://bugzilla.redhat.com/show_bug.cgi?id=904121 [ 3 ] Bug #904122 - wordpress: XSS in the external Plupload library https://bugzilla.redhat.com/show_bug.cgi?id=904122 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update wordpress' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-... (Log in to post comments)
|
|||||||||||||||||||