Bug 666781 (CVE-2010-4536)

Summary: CVE-2010-4536 Wordpress: XSS flaw in HTML sanitation library
Product: [Other] Security Response Reporter: Huzaifa S. Sidhpurwala <huzaifas>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: limburgher, vkrizan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: public=20101229,reported=20101230,source=debian,impact=moderate,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N,fedora-all/wordpress=affected,cwe=CWE-79[auto]
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 666782, 668192    
Bug Blocks:    

Description Huzaifa S. Sidhpurwala 2011-01-03 02:18:13 EST
A Cross-site scripting(XSS) flaw was found in KSES, which 
is the wordpress HTML sanitation library.

References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608405
http://wordpress.org/news/2010/12/3-0-4-update/

Upstream changeset:
http://core.trac.wordpress.org/changeset/17172/branches/3.0
Comment 1 Huzaifa S. Sidhpurwala 2011-01-03 02:19:33 EST
Pending CVE request at:
http://thread.gmane.org/gmane.comp.security.oss.general/3995
Comment 2 Huzaifa S. Sidhpurwala 2011-01-03 02:21:47 EST
Created wordpress tracking bugs for this issue

Affects: fedora-all [bug 666782]