[SECURITY] [DLA 1960-1] wordpress security update

2019-10-1720:21:46

lists.debian.org

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

7.2 High

AI Score

Confidence

High

0.043 Low

EPSS

Percentile

92.4%

JSON

Package : wordpress
Version : 4.1.27+dfsg-0+deb8u1
CVE ID : CVE-2019-16217 CVE-2019-16218 CVE-2019-16219
CVE-2019-16220 CVE-2019-16221 CVE-2019-16222
CVE-2019-16223
Debian Bug : 939543

Several cross-site scripting (XSS) vulnerabilities were discovered in
Wordpress, a popular content management framework. An attacker can use
these flaws to send malicious scripts to an unsuspecting user.

For Debian 8 "Jessie", these problems have been fixed in version
4.1.27+dfsg-0+deb8u1.

We recommend that you upgrade your wordpress packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10allwordpress-l10n< 5.0.4+dfsg1-1+deb10u1wordpress-l10n_5.0.4+dfsg1-1+deb10u1_all.deb
Debian10allwordpress-theme-twentysixteen< 5.0.4+dfsg1-1+deb10u1wordpress-theme-twentysixteen_5.0.4+dfsg1-1+deb10u1_all.deb
Debian10allwordpress-theme-twentyseventeen< 5.0.4+dfsg1-1+deb10u1wordpress-theme-twentyseventeen_5.0.4+dfsg1-1+deb10u1_all.deb
Debian9allwordpress-l10n< 4.7.5+dfsg-2+deb9u6wordpress-l10n_4.7.5+dfsg-2+deb9u6_all.deb
Debian9allwordpress-theme-twentyfifteen< 4.7.5+dfsg-2+deb9u6wordpress-theme-twentyfifteen_4.7.5+dfsg-2+deb9u6_all.deb
Debian8allwordpress-theme-twentyfifteen< 4.1.27+dfsg-0+deb8u1wordpress-theme-twentyfifteen_4.1.27+dfsg-0+deb8u1_all.deb
Debian8allwordpress-l10n< 4.1.27+dfsg-0+deb8u1wordpress-l10n_4.1.27+dfsg-0+deb8u1_all.deb
Debian8allwordpress< 4.1.27+dfsg-0+deb8u1wordpress_4.1.27+dfsg-0+deb8u1_all.deb
Debian9allwordpress-theme-twentysixteen< 4.7.5+dfsg-2+deb9u6wordpress-theme-twentysixteen_4.7.5+dfsg-2+deb9u6_all.deb
Debian9allwordpress-theme-twentyseventeen< 4.7.5+dfsg-2+deb9u6wordpress-theme-twentyseventeen_4.7.5+dfsg-2+deb9u6_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	wordpress-l10n	< 5.0.4+dfsg1-1+deb10u1	wordpress-l10n_5.0.4+dfsg1-1+deb10u1_all.deb
Debian	10	all	wordpress-theme-twentysixteen	< 5.0.4+dfsg1-1+deb10u1	wordpress-theme-twentysixteen_5.0.4+dfsg1-1+deb10u1_all.deb
Debian	10	all	wordpress-theme-twentyseventeen	< 5.0.4+dfsg1-1+deb10u1	wordpress-theme-twentyseventeen_5.0.4+dfsg1-1+deb10u1_all.deb
Debian	9	all	wordpress-l10n	< 4.7.5+dfsg-2+deb9u6	wordpress-l10n_4.7.5+dfsg-2+deb9u6_all.deb
Debian	9	all	wordpress-theme-twentyfifteen	< 4.7.5+dfsg-2+deb9u6	wordpress-theme-twentyfifteen_4.7.5+dfsg-2+deb9u6_all.deb
Debian	8	all	wordpress-theme-twentyfifteen	< 4.1.27+dfsg-0+deb8u1	wordpress-theme-twentyfifteen_4.1.27+dfsg-0+deb8u1_all.deb
Debian	8	all	wordpress-l10n	< 4.1.27+dfsg-0+deb8u1	wordpress-l10n_4.1.27+dfsg-0+deb8u1_all.deb
Debian	8	all	wordpress	< 4.1.27+dfsg-0+deb8u1	wordpress_4.1.27+dfsg-0+deb8u1_all.deb
Debian	9	all	wordpress-theme-twentysixteen	< 4.7.5+dfsg-2+deb9u6	wordpress-theme-twentysixteen_4.7.5+dfsg-2+deb9u6_all.deb
Debian	9	all	wordpress-theme-twentyseventeen	< 4.7.5+dfsg-2+deb9u6	wordpress-theme-twentyseventeen_4.7.5+dfsg-2+deb9u6_all.deb