--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2020-761bce8292
2020-06-29 00:31:43.316306
--------------------------------------------------------------------------------
Name : wordpress
Product : Fedora EPEL 7
Version : 5.1.6
Release : 1.el7
URL :
http://www.wordpress.org
Summary : Blog tool and publishing platform
Description :
Wordpress is an online publishing / weblog package that makes it very easy,
almost trivial, to get information out to people on the web.
Important information in /usr/share/doc/wordpress-5.1.6/README.fedora
--------------------------------------------------------------------------------
Update Information:
**WordPress 5.1.6 Security Release** **Security Updates** * Props to Sam
Thomas (jazzy2fives) for finding an XSS issue where authenticated users with low
privileges are able to add JavaScript to posts in the block editor. * Props
to Luigi ��� (gubello.me) for discovering an XSS issue where authenticated users
with upload permissions are able to add JavaScript to media files. * Props to
Ben Bidner of the WordPress Security Team for finding an open redirect issue in
wp_validate_redirect(). * Props to Nrimo Ing Pandum for finding an
authenticated XSS issue via theme uploads. * Props to Simon Scannell of RIPS
Technologies for finding an issue where set-screen-option can be misused by
plugins leading to privilege escalation. * Props to Carolina Nymark for
discovering an issue where comments from password-protected posts and pages
could be displayed under certain conditions.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jun 11 2020 Remi Collet <remi(a)remirepo.net> - 5.1.6-1
- WordPress 5.1.6 Security Release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1848680 - CVE-2020-4046 wordpress: authenticated XSS through embed block
https://bugzilla.redhat.com/show_bug.cgi?id=1848680
[ 2 ] Bug #1848684 - CVE-2020-4047 wordpress: authenticated XSS via media attachment
page
https://bugzilla.redhat.com/show_bug.cgi?id=1848684
[ 3 ] Bug #1848689 - CVE-2020-4048 wordpress: open redirect in wp_validate_redirect
function
https://bugzilla.redhat.com/show_bug.cgi?id=1848689
[ 4 ] Bug #1848692 - CVE-2020-4049 wordpress: authenticated self-XSS via theme uploads
https://bugzilla.redhat.com/show_bug.cgi?id=1848692
[ 5 ] Bug #1848697 - CVE-2020-4050 wordpress: set-screen-option filter misuse by plugins
leads to privilege escalation
https://bugzilla.redhat.com/show_bug.cgi?id=1848697
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update wordpress' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------