[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CABRvpqDSf25+YyDZj4gC=F7PKc=3cymHBx=bzh1mpGTBYBu19Q@mail.gmail.com>
Date: Wed, 11 Sep 2013 17:28:26 -0400
From: Andrew Nacin <nacin@...dpress.org>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: CVE Requests for WordPress 3.6.1
Three issues fixed in WordPress 3.6.1:
http://codex.wordpress.org/Version_3.6.1
* Unsafe PHP unserialization. CWE-502.
http://core.trac.wordpress.org/changeset/25325.
* Open Redirect / Insufficient Input Validation. CWE-601.
http://core.trac.wordpress.org/changeset/25323 and
http://core.trac.wordpress.org/changeset/25324.
* Privilege Escalation: a user with an Author role, using a specially
crafted request, was able to create a post that was marked as "written by"
another user. http://core.trac.wordpress.org/changeset/25321.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
