Created attachment 180598 [details] Patch WordPress 4.7.3 Security and Maintenance Release: https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7.2 and earlier are affected by six security issues: Cross-site scripting (XSS) via media file metadata. Reported by Chris Andrè Dale, Yorick Koster, and Simon P. Briggs. Control characters can trick redirect URL validation. Reported by Daniel Chatfield. Unintended files can be deleted by administrators using the plugin deletion functionality. Reported by xuliang. Cross-site scripting (XSS) via video URL in YouTube embeds. Reported by Marc Montpas. Cross-site scripting (XSS) via taxonomy term names. Reported by Delta. Cross-site request forgery (CSRF) in Press This leading to excessive use of server resources. Reported by Sipke Mellema. This Patch will Update the following ports: www/wordpress chinese/wordpress-zh_CN chinese/wordpress-zh_TW german/wordpress japanese/wordpress poudriere build fine for: 9.3 amd + i386 10.3 amd + i386 12-current amd + i386 (r313761) Cheers jochen
Aloha Jochen, since i'm already doing the updates for our customers, i grep your PR too ;) Did you ever tried to update a vuxml entry? Have a look at security/vuxml. You already know my email if you have any questions. ;) The vuxml entry should be added whenever security is concerned. Its a way to say the user via pkg audit that there are known security issues at his computer. Greetings, Torsten
(In reply to Torsten Zuehlsdorff from comment #1) Heya Torsten, a long time ago,Beat explained to me on IRC. I will search in my IRC logs. I'll try it.
Aloha Jochen, its a simple (but confusing) XML (=text) file. Have a look at it and an older wordpress entry. This should be enough for the first try! Greetings, Torsten
A commit references this bug: Author: tz Date: Tue Mar 7 13:56:45 UTC 2017 New revision: 435603 URL: https://svnweb.freebsd.org/changeset/ports/435603 Log: chinese/wordpress-zh_CN, chinese/wordpress-zh_TW, german/wordpress, japanese/wordpress and www/wordpress, : Update from 4.7.2 to 4.7.3 Changelog: https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ This update fixes 6 security issues. PR: 217608 Submitted by: Jochen Neumeister (maintainer) MFH: 2017Q1 Changes: head/chinese/wordpress-zh_CN/Makefile head/chinese/wordpress-zh_CN/distinfo head/chinese/wordpress-zh_TW/Makefile head/chinese/wordpress-zh_TW/distinfo head/german/wordpress/Makefile head/german/wordpress/distinfo head/japanese/wordpress/Makefile head/japanese/wordpress/distinfo head/www/wordpress/Makefile head/www/wordpress/distinfo
(In reply to Torsten Zuehlsdorff from comment #1) Hey Torsten, you got eMail! ;-)
A commit references this bug: Author: tz Date: Wed Mar 8 10:26:57 UTC 2017 New revision: 435666 URL: https://svnweb.freebsd.org/changeset/ports/435666 Log: MFH: r435603 chinese/wordpress-zh_CN, chinese/wordpress-zh_TW, german/wordpress, japanese/wordpress and www/wordpress, : Update from 4.7.2 to 4.7.3 Changelog: https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ This update fixes 6 security issues. PR: 217608 Submitted by: Jochen Neumeister (maintainer) Approved by: ports-secteam (junovitch) Changes: _U branches/2017Q1/ branches/2017Q1/chinese/wordpress-zh_CN/Makefile branches/2017Q1/chinese/wordpress-zh_CN/distinfo branches/2017Q1/chinese/wordpress-zh_TW/Makefile branches/2017Q1/chinese/wordpress-zh_TW/distinfo branches/2017Q1/german/wordpress/Makefile branches/2017Q1/german/wordpress/distinfo branches/2017Q1/japanese/wordpress/Makefile branches/2017Q1/japanese/wordpress/distinfo branches/2017Q1/www/wordpress/Makefile branches/2017Q1/www/wordpress/distinfo
A commit references this bug: Author: tz Date: Wed Mar 8 13:19:22 UTC 2017 New revision: 435685 URL: https://svnweb.freebsd.org/changeset/ports/435685 Log: Document wordpress security issues PR: 217608, 217598 Security: https://vuxml.FreeBSD.org/freebsd/82752070-0349-11e7-b48d-00e04c1ea73d.html Changes: head/security/vuxml/vuln.xml
Aloha Jochen, i used your send vuxml nearly unchanged. Just fixed some copy-paste errors. You can see the diff in the log. Thank you very much! Torsten