Stay Secure with the Latest Linux Advisories

security advisoryhigh severityremote access

Arch Linux: ASA-201609-32 High Severity: WordPress Remote Access Issues

The package wordpress before version 4.6.1-1 is vulnerable to multiple issues including directory traversal and cross-site scripting. . Arch Linux Security Advisory ASA-201609-32 ========================================= Severity: High Date : 2016-09-30 CVE-ID : CVE-2016-7168 CVE-2016-7169 Package : wordpress Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/title/CVE Summary ====== The package wordpress before version 4.6.1-1 is vulnerable to multiple issues including directory traversal and cross-site scripting. Resolution ========= Upgrade to 4.6.1-1. # pacman -Syu "wordpress> =4.6.1-1" The problems have been fixed upstream in version 4.6.1. Workaround ========= None. Description ========== - CVE-2016-7168 (cross-site scripting) A cross-site scripting vulnerability has been discovered via a malicious image filename, reported by SumOfPwn researcher Cengiz Han Sahin. A WordPress admin can be tricked into uploading a malicious image file requested by a user this admin trusts or a popular malicious image that was spread via social media. - CVE-2016-7169 (directory traversal) A path traversal vulnerability has been discovered in the upgrade package uploader, reported by Dominik Schilling from the WordPress security team. Impact ===== A remote attacker is able to take advantage of a directory traversal vulnerability via the upgrade package uploader or perform a persistent cross-site scripting attack by tricking an admin into uploading a malicious image filename. References ========= https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/ https://www.openwall.com/lists/oss-security/2016/09/08/24 https://www.cve.org/CVERecord?id=CVE-2016-7168 https://www.cve.org/CVERecord?id=CVE-2016-7169 . Arch Linux Security Bulletin ASA-202310-07 addresses critical issues in Drupal that have been mitigated through updates.. wordpress vulnerabilities, arch linux advisory, high severity issues. .LinuxSecurity.com Team

Sep 30, 2016 ArchLinux