-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Package: wordpress Severity: grave Version: 3.3.2+dfsg-1
[CC-in d-devel@l.d.o to discuss this] Hi, although I think the wordpress maintainer are doing all they can do to keep wordpress in a good shape in Debian, I do not think that it is possible to support a stable version with security fixes as we expect it for our releases. The last security update shows that the wordpress upstream is not interested in helping by documenting their patches or shipping proper point-releases to at least some versions. Being forced to upgrade to a new major version by a stable security support is nothing we should force our users to. Debian stable is known for (usually) painfree updates and bugfixes only, not for shipping completely new versions with a forced migration. Therefore - in my opinion - we should not ship wordpress in Wheezy, at least not until upstream handles such issues in a sane way. Cheers, Bernd - -------- Original Message -------- Subject: [SECURITY] [DSA 2670-1] wordpress security update Resent-Date: Fri, 11 May 2012 20:41:44 +0000 (UTC) Resent-From: debian-security-annou...@lists.debian.org Date: Fri, 11 May 2012 22:41:14 +0200 From: Yves-Alexis Perez <cor...@debian.org> Reply-To: debian-secur...@lists.debian.org To: debian-security-annou...@lists.debian.org - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-2670-1 secur...@debian.org http://www.debian.org/security/ Yves-Alexis Perez May 11, 2012 http://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : wordpress Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2011-3122 CVE-2011-3125 CVE-2011-3126 CVE-2011-3127 CVE-2011-3128 CVE-2011-3129 CVE-2011-3130 CVE-2011-4956 CVE-2011-4957 CVE-2012-2399 CVE-2012-2400 CVE-2012-2401 CVE-2012-2402 CVE-2012-2403 CVE-2012-2404 Debian Bug : 670124 Several vulnerabilities were identified in Wordpress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the Wordpress package to the latest upstream version instead of backporting the patches. This means extra care should be taken when upgrading, especially when using third-party plugins or themes, since compatibility may have been impacted along the way. We recommend that users check their install before doing the upgrade. For the stable distribution (squeeze), those problems have been fixed in version 3.3.2+dfsg-1~squeeze1. For the testing distribution (wheezy) and the unstable distribution (sid), those problems have been fixed in version 3.3.2+dfsg-1. We recommend that you upgrade your wordpress packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-annou...@lists.debian.org - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJPrXyJAAoJEL97/wQC1SS+4EcH/1nAhgTx17pMJF7JbWFNG2ZY /xSD6v4MDj3pLiZrntRx4c3y+Kbx91QKBN6KgqDxyHjDLoZgoNVVGwyozGjS2VBn m2OwnjzLUJVqd77R+mUj5h3yEVS1d4O+VcYRcpugPTaD17d90rlPGL2HkZXnQAk1 OjOKGns+yiapuLpcHmNz5cjwvJxaNe355aZlwSUjFWumqtGjQcgyJeKy1XGW0s2o h9YnLXGRNwtihXz0P+5qx7Qwcri3PXLn1Uapp2RSJStkNfiRjSJoqUkb5wqvhT7x O6GhUWShBF6pZ11uvOySY2yU5jPOQDufSUn6T4R5CL4hYJ6Bif6iqkHznPubHeE= =M38G - -----END PGP SIGNATURE----- - -- To UNSUBSCRIBE, email to debian-security-announce-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/87ipg2e9hx....@mid.deneb.enyo.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCAAGBQJPrtniAAoJEOs2Fxpv+UNf1TMP/RsGS4DGRSe0i6F2dt/QVnvF Vcbe9UPTnNxfQlN62hDuhvck+v3c4wNwoXW5iblJ9FCJXjCM9Lvl/6aRXnE4E0QH 1TUf2vzDNmI6IUVtD+bdbVopBuqhOpmJOG+96HQua/aPIIhgjw6C4SzcFU+WyE6R AC2Vm98/spmr73fBn/bXH0NPlcOERoJl8rwORsM+fnevRgnknbWasmwHNeKXJwKT dN6HnWtEHjRqEqus2JUOJpqL0bYvWLo22WSdZIETuPWVHslMtgDsfWEuEN4bJtq8 aYqYBJ3SCYK4phSYfBpdukFkmOkVhB5mG+PqwG+32Ib9TEufH+guxmMj0Gpt3lMj KddKDSIFrwUUKESVy0NYRIJLiGPpHW1Tb/dc7HJry7+ls+2+iAvQjDMFuJ1MtO2t zemN7uKAqL72JBLkvC44i8PXuKvvGaaroC2HGTKpxz9JesZlw/yDzvama268w4bY RBkCeewPklMsKesJXzWM6NzcFnFr4s1PKO+dGHkCut83tlRY2u8O95agGNeFkxIt +skWpaAoV5BM7XFcyzzY2s6u6/nDGMaANHJDimci0YCT0fQbZms3KhXYU5eow/tv U7/ynZvEMrRkaNlKoBSzn1rAgeP9bFsCAtob7xfP2rtB862Va1MzsdXfWfdS+w8a FLRn9NVg5kWeH01K9kQJ =UM+T -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4faed9ed.10...@bzed.de
