wordpress - security update

Several vulnerabilities were discovered in wordpress, a web blogging
tool. The Common Vulnerabilities and Exposures project identifies the
following issues.

• CVE-2015-8834
  Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in
  WordPress before 4.2.2 allows remote attackers to inject arbitrary
  web script or HTML via a long comment that is improperly stored
  because of limitations on the MySQL TEXT data type.
  NOTE: this vulnerability exists because of an incomplete fix for
  CVE-2015-3440
• CVE-2016-4029
  WordPress before 4.5 does not consider octal and hexadecimal IP
  address formats when determining an intranet address, which allows
  remote attackers to bypass an intended SSRF protection mechanism
  via a crafted address.
• CVE-2016-5836
  The oEmbed protocol implementation in WordPress before 4.5.3 allows
  remote attackers to cause a denial of service via unspecified
  vectors.
• CVE-2016-6634
  Cross-site scripting (XSS) vulnerability in the network settings
  page in WordPress before 4.5 allows remote attackers to inject
  arbitrary web script or HTML via unspecified vectors.
• CVE-2016-6635
  Cross-site request forgery (CSRF) vulnerability in the
  wp_ajax_wp_compression_test function in wp-admin/includes/ajaxactions.php
  in WordPress before 4.5 allows remote attackers to
  hijack the authentication of administrators for requests that
  change the script compression option.
• CVE-2016-7168
  Fix a cross-site scripting vulnerability via image filename.
• CVE-2016-7169
  Fix a path traversal vulnerability in the upgrade package uploader.

For Debian 7 Wheezy, these problems have been fixed in version
3.6.1+dfsg-1~deb7u12.

We recommend that you upgrade your wordpress packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: <https://wiki.debian.org/LTS&gt;