[arch-security] [ASA-201510-24] wordpress: multiple issues
anthraxx at archlinux.org
Fri Oct 30 02:13:05 UTC 2015
Arch Linux Security Advisory ASA-201510-24
Date : 2015-10-30
CVE-ID : 2015-5714 2015-5715 CVE-2015-7989
Package : wordpress
Type : multiple issues
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package wordpress before version 4.3.1-1 is vulnerable to cross-side
scripting and insufficient permission restriction.
Upgrade to 4.3.1-1.
# pacman -Syu "wordpress>=4.3.1-1"
The problems have been fixed upstream in version 4.3.1.
- CVE-2015-5714 (cross-side scripting)
A cross-site scripting vulnerability has been discovered when processing
- CVE-2015-5715 (insufficient permission restriction)
A vulnerability has been discovered, allowing users without proper
permissions to publish private posts and make them sticky.
- CVE-2015-7989 (cross-side scripting)
A cross-site scripting vulnerability has been discovered in the user
A remote attacker is able do perform cross-side scripting attacks or
publish private posts and make them sticky.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security