Improper Input Validation Affecting wordpress package, versions <3.5.2+dfsg-1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIANUNSTABLE-WORDPRESS-363607
- published 8 Jul 2013
- disclosed 8 Jul 2013
How to fix?
Upgrade Debian:unstable
wordpress
to version 3.5.2+dfsg-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream wordpress
package and not the wordpress
package as distributed by Debian
.
See How to fix?
for Debian:unstable
relevant fixed versions and status.
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.
References
- https://security-tracker.debian.org/tracker/CVE-2013-2204
- http://www.debian.org/security/2013/dsa-2718
- https://github.com/moxiecode/moxieplayer/commit/b61ac518ffa2657e2dc9019b2dcf2f3f37dbfab0
- http://codex.wordpress.org/Version_3.5.2
- http://wordpress.org/news/2013/06/wordpress-3-5-2/
- https://bugzilla.redhat.com/show_bug.cgi?id=976784