MGASA-2014-0493

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2014-0493.html
Import Source
https://advisories.mageia.org/MGASA-2014-0493.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2014-0493
Related
Published
2014-11-26T17:29:06Z
Modified
2014-11-26T17:11:57Z
Summary
Updated wordpress package fixes security vulnerabilities
Details

XSS in wptexturize() via comments or posts, exploitable for unauthenticated users (CVE-2014-9031).

XSS in media playlists (CVE-2014-9032).

CSRF in the password reset process (CVE-2014-9033).

Denial of service for giant passwords. The phpass library by Solar Designer was used in both projects without setting a maximum password length, which can lead to CPU exhaustion upon hashing (CVE-2014-9034).

XSS in Press This (CVE-2014-9035).

XSS in HTML filtering of CSS in posts (CVE-2014-9036).

Hash comparison vulnerability in old-style MD5-stored passwords (CVE-2014-9037).

SSRF: Safe HTTP requests did not sufficiently block the loopback IP address space (CVE-2014-9038).

Previously an email address change would not invalidate a previous password reset email (CVE-2014-9039).

References
Credits

Affected packages

Mageia:4 / wordpress

Package

Name
wordpress
Purl
pkg:rpm/mageia/wordpress?distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.9.3-1.mga4

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / wordpress

Package

Name
wordpress
Purl
pkg:rpm/mageia/wordpress?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.9.3-1.mga3

Ecosystem specific 

{
    "section": "core"
}