[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120417093507.GA7896@kludge.henri.nerv.fi>
Date: Tue, 17 Apr 2012 12:35:07 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: Hanno Böck <hanno@...eck.de>,
Kurt Seifried <kseifried@...hat.com>,
Yves-Alexis Perez <corsac@...ian.org>
Subject: Re: CVE-request: WordPress 3.1.1
I previously requested CVE-identifiers for two WordPress 3.1.1 issues (2011), which are still not assigned.
> 1) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
> http://osvdb.org/show/osvdb/72141
Hanno Böck said in http://seclists.org/oss-sec/2012/q1/151 that CVE-2012-0287 is for this issue.
======================================================
Name: CVE-2012-0287
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0287
Phase: Assigned (20120103)
Category:
Reference: MISC:http://oldmanlab.blogspot.com/2012/01/wordpress-33-xss-vulnerability.html
Reference: CONFIRM:https://wordpress.org/news/2012/01/wordpress-3-3-1/
Reference: SECTRACK:1026542
Reference: URL:http://www.securitytracker.com/id?1026542
Cross-site scripting (XSS) vulnerability in wp-comments-post.php in
WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows
remote attackers to inject arbitrary web script or HTML via the query
string in a POST operation that is not properly handled by the
"Duplicate comment detected" feature.
Current Votes:
None (candidate not yet proposed)
======================================================
It seems to be assigned for 3.3.1 and not for 3.1.1. Sorry for my mistake also in last emails.
> 2) The "make_clickable()" function in wp-includes/formatting.php does not properly check the URL length in comments before passing it to the PCRE library, which can be exploited to cause a crash.
> http://osvdb.org/show/osvdb/72142
>
> http://wordpress.org/news/2011/04/wordpress-3-1-1/
> http://secunia.com/advisories/44038/
> http://seclists.org/cert/2011/63
Still no CVE.
> I even contacted WordPress administrators and asked if this does have CVE, but they haven't replied for some reason.
Still no answer.
Can we now assign CVE-identifiers for 3.1.1 issues, thanks? List of issues in 3.1.1 can be found from here http://core.trac.wordpress.org/query?status=closed&resolution=fixed&milestone=3.1.1&group=resolution&order=priority and related news article in here http://wordpress.org/news/2011/04/wordpress-3-1-1/
- Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
