Debian DLA-236-1 : wordpress security update

medium Nessus Plugin ID 83918


The remote Debian host is missing a security update.


In the Debian squeeze-lts version of Wordpress, multiple security issues have been fixed :

Remote attackers could...

- ... upload files with invalid or unsafe names

- ... mount social engineering attacks

- ... compromise a site via cross-site scripting

- ... inject SQL commands

- ... cause denial of service or information disclosure


Jouko Pynnonen discovered an unauthenticated cross site scripting vulnerability (XSS) in wptexturize(), exploitable via comments or posts.


Cross site request forgery (CSRF) vulnerability in the password changing process, which could be used by an attacker to trick an user into changing her password.


Javier Nieto Arevalo and Andres Rojas Guerrero reported a potential denial of service in the way the phpass library is used to handle passwords, since no maximum password length was set.


John Blackbourn reported an XSS in the 'Press This' function (used for quick publishing using a browser 'bookmarklet').


Robert Chapin reported an XSS in the HTML filtering of CSS in posts.


David Anderson reported a hash comparison vulnerability for passwords stored using the old-style MD5 scheme. While unlikely, this could be exploited to compromise an account, if the user had not logged in after a Wordpress 2.5 update (uploaded to Debian on 2 Apr, 2008) and the password MD5 hash could be collided with due to PHP dynamic comparison.


Ben Bidner reported a server side request forgery (SSRF) in the core HTTP layer which unsufficiently blocked the loopback IP address space.


Momen Bassel, Tanoy Bose, and Bojan Slavkovic reported a vulnerability in the password reset process: an email address change would not invalidate a previous password reset email.


Cedric Van Bockhaven reported and Gary Pendergast, Mike Adams, and Andrew Nacin of the WordPress security team fixed a cross-site-scripting vulnerabilitity, which could enable anonymous users to compromise a site.


Jakub Zoczek discovered a very limited cross-site scripting vulnerability, that could be used as part of a social engineering attack.


Jouko Pynnönen discovered a cross-site scripting vulnerability, which could enable commenters to compromise a site.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Upgrade the affected wordpress, and wordpress-l10n packages.

See Also

Plugin Details

Severity: Medium

ID: 83918

File Name: debian_DLA-236.nasl

Version: 2.7

Type: local

Agent: unix

Published: 6/2/2015

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information


Risk Factor: Medium

Score: 5.9


Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:wordpress, p-cpe:/a:debian:debian_linux:wordpress-l10n, cpe:/o:debian:debian_linux:6.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/1/2015

Reference Information

CVE: CVE-2014-9031, CVE-2014-9033, CVE-2014-9034, CVE-2014-9035, CVE-2014-9036, CVE-2014-9037, CVE-2014-9038, CVE-2014-9039, CVE-2015-3438, CVE-2015-3439, CVE-2015-3440

BID: 74269, 74334, 71231, 71232, 71233, 71234, 71236, 71237, 71238