[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150804184256.C8CD472E04C@smtpvbsrv1.mitre.org>
Date: Tue, 4 Aug 2015 14:42:56 -0400 (EDT)
From: cve-assign@...re.org
To: henri@...v.fi
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: WordPress 4.2.3 and earlier multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> Can I get CVE for WordPress 4.2.3 and earlier multiple vulnerabilities
> https://codex.wordpress.org/Version_4.2.4 says:
>
> "WordPress 4.2.4 fixes three cross-site scripting vulnerabilities and a
> potential SQL injection that could be used to compromise a site
> (CVE-2015-2213)."
The correct parsing of that sentence is like:
WordPress 4.2.4 fixes three cross-site scripting vulnerabilities and
[a potential SQL injection that could be used to compromise a site
(CVE-2015-2213)]
not like:
[WordPress 4.2.4 fixes three cross-site scripting vulnerabilities and
a potential SQL injection that could be used to compromise a site]
(CVE-2015-2213)
See below for the set of 6 CVE IDs that correspond to the currently
available information.
> https://core.trac.wordpress.org/changeset/33555
> https://core.trac.wordpress.org/changeset/33556
> "Comments: IDs are integers"
Use CVE-2015-2213 only for this SQL injection issue.
> https://core.trac.wordpress.org/changeset/33535
> https://core.trac.wordpress.org/changeset/33536
> "Customizer: Use hash_equals() for widgets" aka "a fix for a
> potential timing side-channel attack"
Use CVE-2015-5730.
> https://core.trac.wordpress.org/changeset/33542
> https://core.trac.wordpress.org/changeset/33543
> "Heartbeat: Ensure post locks are released" aka "prevents an attacker
> from locking a post from being edited"
Use CVE-2015-5731.
> cross-site scripting vulnerabilities
> https://core.trac.wordpress.org/changeset/33529
> "Nav menus: Consistent titles in widgets"
Use CVE-2015-5732.
> https://core.trac.wordpress.org/changeset/33540
> https://core.trac.wordpress.org/changeset/33541
> "Nav menus: Adjust redundant titles in accessibility helpers"
Use CVE-2015-5733.
> https://core.trac.wordpress.org/changeset/33549
> "Themes: Fix some broken links in the legacy theme preview."
Use CVE-2015-5734.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJVwQcxAAoJEKllVAevmvmsQg8H/3xFZy/FzLYeOJh9oQS0NmYc
gjVMTeiG5eWf+rlw2hHu/caJLNC0lQGJOdhp5IjKmt0YmNA6Uai5WVkK9NtfJQEu
9WdPEWQXiHxf2qenhYZOOUedWDwxxx2B2X6NRbAMsfa61yYS0iyU8/CCXKEb28sn
pHMfAO+a7ejhbXE589mrRTBckmKmVWkpNjE/dzKP1CBxroj3AXBfyhzIzSkZ8FRw
cfAYY9AfKDYZpxY0BGPF/TuxFq06ptxp+oHcTj6bEAj0F1CmgcprKf44v232X0mR
+aLhA6W2dBfMzY2k9MwNhpQznldai0lto/XEjiAA67JqduWoZP87b44Jr7wNKpE=
=MlpN
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
