A wordpress security update has been released for Debian GNU/Linux 8 LTS to address several vulnerabilities.
DLA 2269-1: wordpress security update
Package : wordpress
Version : 4.1.31+dfsg-0+deb8u1
CVE ID : CVE-2020-4046 CVE-2020-4047 CVE-2020-4048
CVE-2020-4049 CVE-2020-4050
Debian Bug : 962685
Several vulnerabilities were discovered in Wordpress, a web
blogging tool. They allowed remote attackers to perform
various Cross-Side Scripting (XSS) attacks, create open
redirects, escalate privileges, and bypass authorization
access.
CVE-2020-4046
In affected versions of WordPress, users with low
privileges (like contributors and authors) can use the
embed block in a certain way to inject unfiltered HTML
in the block editor. When affected posts are viewed by a
higher privileged user, this could lead to script
execution in the editor/wp-admin.
CVE-2020-4047
In affected versions of WordPress, authenticated users with
upload permissions (like authors) are able to inject
JavaScript into some media file attachment pages in a certain
way. This can lead to script execution in the context of a
higher privileged user when the file is viewed by them.
CVE-2020-4048
In affected versions of WordPress, due to an issue in
wp_validate_redirect() and URL sanitization, an arbitrary
external link can be crafted leading to unintended/open
redirect when clicked.
CVE-2020-4049
In affected versions of WordPress, when uploading themes, the
name of the theme folder can be crafted in a way that could
lead to JavaScript execution in /wp-admin on the themes page.
This does require an admin to upload the theme, and is low
severity self-XSS.
CVE-2020-4050
In affected versions of WordPress, misuse of the
`set-screen-option` filter's return value allows arbitrary
user meta fields to be saved. It does require an admin to
install a plugin that would misuse the filter. Once installed,
it can be leveraged by low privileged users.
For Debian 8 "Jessie", these problems have been fixed in version
4.1.31+dfsg-0+deb8u1.
We recommend that you upgrade your wordpress packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
