Source: wordpress
Version: 5.2.2+dfsg1-1
Severity: normal
Tags: security

Wordpress has release 5.2.3 which fixes several security holes.


Security Updates
Props to Simon Scannell of RIPS Technologies for finding and disclosing two 
issues. The first, a cross-site scripting (XSS) vulnerability found in post 
previews by contributors. The second was a cross-site scripting vulnerability 
in stored comments.
Props to Tim Coen for disclosing an issue where validation and sanitization of 
a URL could lead to an open redirect.
Props to Anshul Jain for disclosing reflected cross-site scripting during media 
Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a 
vulnerability for cross-site scripting (XSS) in shortcode previews.
Props to Ian Dunn of the Core Security Team for finding and disclosing a case 
where reflected cross-site scripting could be found in the dashboard.
Props to Soroush Dalili (@irsdl) from NCC Group for disclosing an issue with 
URL sanitization that can lead to cross-site scripting (XSS) attacks.
In addition to the above changes, we are also updating jQuery on older versions 
of WordPress. This change was added in 5.2.1 and is now being brought to older 

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-5-amd64 (SMP w/6 CPU cores)
Locale: LANG=en_AU.utf8, LC_CTYPE=en_AU.utf8 (charmap=UTF-8), LANGUAGE=en_AU:en 
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Reply via email to