Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Fedora 20 Security Update: FEDORA-2015-6790 Moderate WordPress XSS

fedora
Calendar Grey May 20, 2015
Scroller Fedora
Crucial Fedora 20 patch for WordPress resolves multiple vulnerabilities, boosting security and reliability.
**WordPress 4.2 “Powell” ** * Upstream announcement https://wordpress.org/news/2015/04/powell/ **WordPress 4.2.1 Security Release** * Upstream announcement https://word...

Summary

Wordpress is an online publishing / weblog package that makes it very easy,

almost trivial, to get information out to people on the web.

Important information in /usr/share/doc/wordpress/README.fedora

Update Information:

**WordPress 4.2 “Powell” ** * Upstream announcement https://wordpress.org/news/2015/04/powell/

**WordPress 4.2.1 Security Release** * Upstream announcement https://wordpress.org/news/2015/04/wordpress-4-2-1/

**WordPress 4.2.2 Security and Maintenance Release** * Upstream announcement https://wordpress.org/news/2015/05/wordpress-4-2-2/

Topics%20covered

Topics Covered

security advisory Fedora cross-site scripting moderate severity update information security release wordpress

Change Log

* Thu May 7 2015 Remi Collet - 4.2.2-1 - WordPress 4.2.2 Security and Maintenance Release * Tue Apr 28 2015 Remi Collet - 4.2.1-1 - WordPress 4.2.1 Security Release - WordPress 4.2 “Powell” * Fri Apr 24 2015 Remi Collet - 4.1.3-1 - WordPress 4.1.3 Maintenance Release * Thu Apr 23 2015 Remi Collet - 4.1.2-1 - WordPress 4.1.2 Security Release * Thu Feb 19 2015 Remi Collet - 4.1.1-1 - WordPress 4.1.1 Maintenance Release * Mon Dec 22 2014 Remi Collet - 4.1-1 - WordPress 4.1 “Dinah” * Fri Nov 21 2014 Remi Collet - 4.0.1-1 - WordPress 4.0.1 Security Release - use system php-getid3 when available #1145574 * Mon Sep 8 2014 Remi Collet - 4.0-1 - WordPress 4.0 “Benny” * Fri Aug 8 2014 Remi Collet - 3.9.2-3 - config dir only readable by apache group, better fix for #1124582 - fix license handling * Thu Aug 7 2014 Remi Collet - 3.9.2-2 - update to 3.9.2 Security Release #1127547 - config file only readable by apache user (httpd or php-fpm) #1124582 * Fri May 9 2014 Remi Collet - 3.9.1-1 - update to 3.9.1 Maintenance Release * Wed May 7 2014 Remi Collet - 3.9-1 - update to 3.9 “Smith” * Tue Apr 15 2014 Remi Collet - 3.8.3-1 - update to 3.8.3 Maintenance Release https://wordpress.org/news/2014/04/wordpress-3-8-3/ * Wed Apr 9 2014 Remi Collet - 3.8.2-1 - update to 3.8.2 Security Release - fix privilege escalation issue CVE-2014-0165 - fix authentication bypass issue CVE-2014-0166 * Sat Jan 25 2014 Remi Collet - 3.8.1-3 - ignore WP_AUTO_UPDATE_CORE (always false) * Fri Jan 24 2014 Remi Collet - 3.8.1-2 - comment provided configuration about auto-updater - disable auto-updater on default configuration #1057521 - switch some sed to patch (more robust) * Thu Jan 23 2014 Adam Williamson - 3.8.1-1 - new upstream release 3.8.1 (bugfixes) * Mon Dec 16 2013 Remi Collet - 3.8-1 - update to 3.8 “Parker” #1043104 - link to README.fedora in package description - add note about optional packages #1037516 - add php dependencies: ereg, ftp, gd, xml - del php dependencies: pdo, reflection

References


[ 1 ] Bug #1214650 - CVE-2015-3438 CVE-2015-3439 wordpress: several vulnerabilities fixed in Wordpress 4.1.2 https://bugzilla.redhat.com/show_bug.cgi?id=1214650 [ 2 ] Bug #1219368 - wordpress: two cross-site scripting flaws fixed in 4.2.2 https://bugzilla.redhat.com/show_bug.cgi?id=1219368 [ 3 ] Bug #1216069 - CVE-2015-3440 wordpress: stored XSS via long comments https://bugzilla.redhat.com/show_bug.cgi?id=1216069

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update wordpress' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
important
Lowest
Low
Medium
High
Critical

Name: wordpress
Product: Fedora 20
Version: 4.2.2
Release: 1.fc20
URL: https://wordpress.org/
Summary: Blog tool and publishing platform

Topics%20covered

Topics Covered

security advisory Fedora cross-site scripting moderate severity update information security release wordpress

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.