Bug 153526 - vuxml entry for www/wordpress CVE-2010-4257
Summary: vuxml entry for www/wordpress CVE-2010-4257
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Po-Chuan Hsieh
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-12-29 19:00 UTC by mark
Modified: 2011-02-05 04:40 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description mark 2010-12-29 19:00:28 UTC 
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
   <vuln vid="510c6cf6-1145-4e3b-a44d-e3c1d9bfabba">
     <topic>wordpress -- </topic>
     <affects>
       <package>
         <name>wordpress</name>
         <range><lt>3.0.2</lt></range>
       </package>
     </affects>
     <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
         <p>Vendor reports:</p>
         <blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4257">
           <p>SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field. </p>
         </blockquote>
       </body>
     </description>
     <references>
      <cvename>CVE-2010-4257</cvename>
      <url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4257</url>
     </references>
     <dates>
       <discovery>2010-11-16</discovery>
       <entry>2010-12-29</entry>
     </dates>
   </vuln>

Fix: 

n/a
How-To-Repeat: n/a
Comment 1 mark 2010-12-30 19:09:23 UTC 
I suggest the vuxml <topic> should say:
wordpress - SQL injection vulnerability

as that is more descriptive.
Comment 2 Po-Chuan Hsieh freebsd_committer freebsd_triage 2010-12-31 01:01:16 UTC 
Responsible Changed
From-To: freebsd-ports-bugs->sunpoet

I will take it.
Comment 3 Martin Wilke freebsd_committer freebsd_triage 2011-02-05 04:36:34 UTC 
State Changed
From-To: open->closed

Committed. Thanks!
Comment 4 dfilter service freebsd_committer freebsd_triage 2011-02-05 04:36:41 UTC 
miwi        2011-02-05 04:36:36 UTC

  FreeBSD ports repository

  Modified files:
    security/vuxml       vuln.xml 
  Log:
  - Add entry for wordpress - SQL injection vulnerability
  
  PR:             153526
  Submitted by:   Mark Foster <mark@foster.cc>
  Feature safe:   yes
  
  Revision  Changes    Path
  1.2294    +34 -1     ports/security/vuxml/vuln.xml
_______________________________________________
cvs-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/cvs-all
To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"