This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 687906 - (CVE-2011-0700, CVE-2011-0701) CVE-2011-0700 CVE-2011-0701 wordpress: multiple vulnerabilities corrected in 3.0.5
CVE-2011-0700 CVE-2011-0701 wordpress: multiple vulnerabilities corrected in ...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
public=20110207,reported=20110208,sou...
: Security
Depends On: 687908 687909 687910 687911
Blocks:
  Show dependency treegraph
 
Reported: 2011-03-15 13:20 EDT by Vincent Danen
Modified: 2012-09-14 18:09 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-09-14 18:09:47 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2011-03-15 13:20:07 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-0700 to
the following vulnerability:

Name: CVE-2011-0700
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0700
Assigned: 20110131
Reference: http://openwall.com/lists/oss-security/2011/02/08/7
Reference: http://openwall.com/lists/oss-security/2011/02/09/13
Reference: http://codex.wordpress.org/Version_3.0.5
Reference: http://core.trac.wordpress.org/changeset/17397
Reference: http://core.trac.wordpress.org/changeset/17401
Reference: http://core.trac.wordpress.org/changeset/17406
Reference: http://core.trac.wordpress.org/changeset/17412
Reference: http://www.wordpress.org/news/2011/02/wordpress-3-0-5/
Reference: http://www.securityfocus.com/bid/46249

Multiple cross-site scripting (XSS) vulnerabilities in WordPress
before 3.0.5 allow remote authenticated users to inject arbitrary web
script or HTML via vectors related to (1) the Quick/Bulk Edit title
(aka post title or post_title), (2) post_status, (3) comment_status,
(4) ping_status, and (5) escaping of tags within the tags meta box.


Common Vulnerabilities and Exposures assigned an identifier CVE-2011-0701 to
the following vulnerability:

Name: CVE-2011-0701
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0701
Assigned: 20110131
Reference: http://openwall.com/lists/oss-security/2011/02/08/7
Reference: http://openwall.com/lists/oss-security/2011/02/09/13
Reference: http://codex.wordpress.org/Version_3.0.5
Reference: http://core.trac.wordpress.org/changeset/17393
Reference: http://www.wordpress.org/news/2011/02/wordpress-3-0-5/
Reference: http://www.securityfocus.com/bid/46249

wp-admin/async-upload.php in the media uploader in WordPress before
3.0.5 allows remote authenticated users to read (1) draft posts or (2)
private posts via a modified attachment_id parameter.
Comment 1 Vincent Danen 2011-03-15 13:26:12 EDT
Created wordpress-mu tracking bugs for this issue

Affects: epel-5 [bug 687910]
Affects: fedora-all [bug 687911]
Comment 2 Vincent Danen 2011-03-15 13:26:15 EDT
Created wordpress tracking bugs for this issue

Affects: epel-all [bug 687908]
Affects: fedora-all [bug 687909]
Comment 3 Vincent Danen 2011-04-12 16:36:45 EDT
wordpress-3.1 is now available on Fedora 13, 14, and 15 as well as EPEL5 and 6.

Note You need to log in before you can comment on or make changes to this bug.