Debian Long Term Support / LTS Security Information / 2017 / Security Information -- DLA-975-1 wordpress

Debian Security Advisory

DLA-975-1 wordpress -- LTS security update

Date Reported:

02 Jun 2017

Affected Packages:

wordpress

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 862053, Bug 862816.
In Mitre's CVE dictionary: CVE-2017-8295, CVE-2017-9061, CVE-2017-9062, CVE-2017-9063, CVE-2017-9064, CVE-2017-9065.

More information:

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues.

• CVE-2017-8295

  Potential unauthorized password reset vulnerability. More information are available at:

  https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html

• CVE-2017-9061

  A cross-site scripting (XSS) vulnerability exists when someone attempts to upload very large files.

• CVE-2017-9062

  Improper handling of post meta data values in the XML-RPC API.

• CVE-2017-9063

  Cross-site scripting (XSS) vulnerability in the customizer.

• CVE-2017-9064

  A Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog.

• CVE-2017-9065

  Lack of capability checks for post meta data in the XML-RPC API.

For Debian 7 Wheezy, these problems have been fixed in version 3.6.1+dfsg-1~deb7u15.

We recommend that you upgrade your wordpress packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS