Bug 1334205 (CVE-2016-4566, CVE-2016-4567)

Summary: CVE-2016-4566 CVE-2016-4567 wordpress: 4.5.2 Security Release
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: fedora, gwync
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: wordpress 4.5.2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-05-09 12:01:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1334206, 1334207    
Bug Blocks:    

Description Andrej Nemec 2016-05-09 07:32:07 UTC
WordPress 4.5.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

CVE-2016-4566: WordPress versions 4.5.1 and earlier are affected by a SOME vulnerability through Plupload, the third-party library WordPress uses for uploading files.

Upstream fix:

https://core.trac.wordpress.org/changeset/37382/

CVE-2016-4567: WordPress versions 4.2 through 4.5.1 are vulnerable to reflected XSS using specially crafted URIs through MediaElement.js, the third-party library used for media players.

Upstream fix:

https://core.trac.wordpress.org/changeset/37371/

External references:

https://wordpress.org/news/2016/05/wordpress-4-5-2/

Comment 1 Andrej Nemec 2016-05-09 07:32:47 UTC
Created wordpress tracking bugs for this issue:

Affects: fedora-all [bug 1334206]
Affects: epel-all [bug 1334207]

Comment 2 Fedora Update System 2016-05-20 17:40:57 UTC
wordpress-4.5.2-2.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2016-05-20 23:47:34 UTC
wordpress-4.5.2-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2016-05-20 23:51:23 UTC
wordpress-4.5.2-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2016-05-26 19:46:25 UTC
wordpress-4.5.2-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2016-05-26 20:48:36 UTC
wordpress-4.5.2-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2016-05-26 20:51:26 UTC
wordpress-4.5.2-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.