Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Sep 2012 13:49:46 -0400
From: Andrew Nacin <>
To: Kurt Seifried <>
Cc:, Hanno Boeck <>,
Subject: Re: CVEs for wordpress 3.4.2 release

On Wed, Sep 12, 2012 at 1:04 PM, Kurt Seifried <> wrote:

> On 09/12/2012 04:38 AM, Hanno Boeck wrote:
> > I can't find CVEs assigend for the issues fixed in wordpress
> > 3.4.2.
> >
> >
> >
> >
> > Sadly, the information is quite limited: "Version 3.4.2 also fixes
> > a few security issues and contains some security hardening. The
> > vulnerabilities included potential privilege escalation and a bug
> > that affects multisite installs with untrusted users. These issues
> > were discovered and fixed by the WordPress security team."
> >
> > I suggest assigning two: 1. potential privilege escalation 2.
> > problem with untrusted users on multisite installations unless
> > someone has more information.
> Can provide clarification on this please?

The second one there is CVE-2012-3383. 3.4.1 remained affected; fixed in

We are more specific on our version pages. From

 * Fix unfiltered HTML capabilities in multisite (this is CVE-2012-3383)
 * Fix possible privilege escalation in the Atom Publishing Protocol
 * Allow operations on network plugins only through the network admin

Details for the other two:

 * AtomPub allowed contributors to publish posts, which is normally reserved
for users of an author role or higher. This should be considered low risk,
impact. An additional mitigating factor is that AtomPub is off by default
rarely enabled. (In WordPress 3.5, AtomPub will no longer be a part of

 * For multisite, plugins that must be activated network-wide could be
activated by a non-network administrator. This is only if they were already
installed by a network administrator, but left inactive. This could also
occur if the network administrator allowed individual site administrators to
manage plugins -- by default, this is not the case, and it is rare. Again,
particularly high risk or impact.


Andrew Nacin
Lead Developer

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ