[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Sep 2012 22:29:04 +0200
From: Yves-Alexis Perez <corsac@...ian.org>
To: oss-security@...ts.openwall.com
Cc: security@...dpress.org
Subject: Re: CVEs for wordpress 3.4.2 release
On mer., 2012-09-12 at 13:38 +0300, Hanno Boeck wrote:
> I can't find CVEs assigend for the issues fixed in wordpress 3.4.2.
>
> http://wordpress.org/news/2012/09/wordpress-3-4-2/
>
>
> Sadly, the information is quite limited:
> "Version 3.4.2 also fixes a few security issues and contains some
> security hardening. The vulnerabilities included potential privilege
> escalation and a bug that affects multisite installs with untrusted
> users. These issues were discovered and fixed by the WordPress security
> team."
>
> I suggest assigning two:
> 1. potential privilege escalation
> 2. problem with untrusted users on multisite installations
> unless someone has more information.
It's alway pretty annoying to try to fix CVEs in wordpress releases,
since they are usually allocated just on some release announcement, and
thus identifying specific commits is pretty hard. It'd be nice if
Wordpress security team could be in the loop since the beginning, it
might help a bit later (so adding them to CC: now)
Regards,
--
Yves-Alexis
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
