Debian LTS: DLA-1742-1: wordpress security update
Summary
CVE-2019-8942
remote code execution in wordpress because an _wp_attached_file Post
Meta entry can be changed to an arbitrary string, such as one ending
with a .jpg?file.php substring. An attacker with author privileges
can execute arbitrary code by uploading a crafted image containing
PHP code in the Exif metadata.
CVE-2019-9787
wordpress does not properly filter comment content, leading to
Remote Code Execution by unauthenticated users in a default
configuration. This occurs because CSRF protection is mishandled,
and because Search Engine Optimization of A elements is performed
incorrectly, leading to XSS. The XSS results in administrative
access.
For Debian 8 "Jessie", these problems have been fixed in version
4.1.26+dfsg-1+deb8u1.
We recommend that you upgrade your wordpress packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS