Bug 1263657 (CVE-2015-5714, CVE-2015-5715, CVE-2015-7989) - CVE-2015-5714 CVE-2015-5715 CVE-2015-7989 wordpress: XSS and permission issue fixed in wordpress 4.3.1
Summary: CVE-2015-5714 CVE-2015-5715 CVE-2015-7989 wordpress: XSS and permission issue...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2015-5714, CVE-2015-5715, CVE-2015-7989
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1263658 1263659
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-09-16 11:15 UTC by Adam Mariš
Modified: 2021-02-17 04:55 UTC (History)
3 users (show)

Fixed In Version: wordpress 4.3.1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-10-29 14:33:00 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2015-09-16 11:15:32 UTC 
Multiple vulnerabilities were found in versions prior to 4.3.1.

1. Cross-site scripting vulnerability when processing shortcode tags (CVE-2015-5714)
2. Cross-site scripting vulnerability in the user list table
3. Vulnerability allowing users without proper permissions to publish private posts and make them sticky (CVE-2015-5715)

Upstream patches:

1. https://github.com/WordPress/WordPress/commit/f72b21af23da6b6d54208e5c1d65ececdaa109c8
2. https://github.com/WordPress/WordPress/commit/f91a5fd10ea7245e5b41e288624819a37adf290a
3. https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab

External reference:

https://wordpress.org/news/2015/09/wordpress-4-3-1/
Comment 1 Adam Mariš 2015-09-16 11:16:26 UTC 
Created wordpress tracking bugs for this issue:

Affects: fedora-all [bug 1263658]
Affects: epel-all [bug 1263659]
Comment 2 Fedora Update System 2015-09-25 07:57:29 UTC 
wordpress-4.3.1-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2015-09-25 10:53:31 UTC 
wordpress-4.3.1-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2015-09-25 12:19:01 UTC 
wordpress-4.3.1-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2015-10-05 19:22:22 UTC 
wordpress-4.3.1-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2015-10-07 03:06:34 UTC 
wordpress-4.3.1-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2015-10-07 04:06:57 UTC 
wordpress-4.3.1-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
Comment 8 Martin Prpič 2015-10-29 14:33:00 UTC 
(In reply to Adam Mariš from comment #0)
> Multiple vulnerabilities were found in versions prior to 4.3.1.
> ...
> 2. Cross-site scripting vulnerability in the user list table

This was additionally assigned CVE-2015-7989:

http://seclists.org/oss-sec/2015/q4/178
Note You need to log in before you can comment on or make changes to this bug.