Bug#880528: wordpress: Unsafe queries with wpdb->prepare

2017-11-28 Thread Dominic Hargreaves
On Thu, Nov 02, 2017 at 06:40:04AM +1100, Craig Small wrote: > Source: wordpress > Version: 4.8.2+dfsg-2 > Severity: grave > Tags: upstream security > Justification: user security hole > > WordPress versions 4.8.2 and earlier are affected by an issue where > $wpdb->prepare() can create unexpected

Bug#880528: wordpress: Unsafe queries with wpdb->prepare

2017-11-02 Thread Salvatore Bonaccorso
Control: retitle -1 wordpress: CVE-2017-16510: Unsafe queries with wpdb->prepare Hi Craig! On Thu, Nov 02, 2017 at 08:05:37PM +, Craig Small wrote: > I did it 4 times. 4th time lucky! > > The reply came in a few minutes ago. Thanks for doing so (it's strange, did several requests recently a

Bug#880528: wordpress: Unsafe queries with wpdb->prepare

2017-11-02 Thread Craig Small
I did it 4 times. 4th time lucky! The reply came in a few minutes ago. On Thu, 2 Nov. 2017, 22:41 Salvatore Bonaccorso, wrote: > Hi Craig, > > On Thu, Nov 02, 2017 at 06:40:04AM +1100, Craig Small wrote: > > I have attempted to get a CVE id for it but the Mitre website is > > throwing errors ag

Bug#880528: wordpress: Unsafe queries with wpdb->prepare

2017-11-02 Thread Salvatore Bonaccorso
Hi Craig, On Thu, Nov 02, 2017 at 06:40:04AM +1100, Craig Small wrote: > I have attempted to get a CVE id for it but the Mitre website is > throwing errors again on the submit button. Did you try to resubmit the request later? Still get an error? Regards, Salvatore

Bug#880528: wordpress: Unsafe queries with wpdb->prepare

2017-11-01 Thread Craig Small
Source: wordpress Version: 4.8.2+dfsg-2 Severity: grave Tags: upstream security Justification: user security hole WordPress versions 4.8.2 and earlier are affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi). WordPress core