Stay Secure with the Latest Linux Advisories

security advisorysecurity issuedebian

Debian: DSA-2901-3 Moderate: WordPress Dependency Fix for Squeeze

The update of wordpress in DSA-2901-2 introduced a wrong versioned dependency on libjs-cropper, making the package uninstallable in the oldstable distribution (squeeze). This update corrects that problem. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-2901-3 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Salvatore Bonaccorso April 21, 2014 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : wordpress CVE ID : CVE-2014-0165 CVE-2014-0166 Debian Bug : 744018 The update of wordpress in DSA-2901-2 introduced a wrong versioned dependency on libjs-cropper, making the package uninstallable in the oldstable distribution (squeeze). This update corrects that problem. For reference the original advisory text follows. Several vulnerabilities were discovered in Wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-0165 A user with a contributor role, using a specially crafted request, can publish posts, which is reserved for users of the next-higher role. CVE-2014-0166 Jon Cave of the WordPress security team discovered that the wp_validate_auth_cookie function in wp-includes/pluggable.php does not properly determine the validity of authentication cookies, allowing a remote attacker to obtain access via a forged cookie. For the oldstable distribution (squeeze), this problem has been fixed in version 3.6.1+dfsg-1~deb6u4. We recommend that you upgrade your wordpress packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . The DSA-2901-3 update addresses a crucial WordPress dependency flaw in the oldstable release,rectifying severe security vulnerabilities.. Debian Security Advisory, WordPress Update, Remote Access Fixes. . LinuxSecurity.com Team

Apr 21, 2014 Debian