153303 2006-10-29 08:15 0000 www-apps/wordpress-2.0.5 version bump 2006-11-17 14:36:39 0000 1 1 1 Unclassified Gentoo Linux Ebuilds unspecified All Other RESOLVED FIXED B3? [glsa] frilled P2 normal --- 1 jesus.de.santos@gmail.com security@gentoo.org bathym@0x656d67.org peter.westwood@ftwr.co.uk pookey@pookey.co.uk superlag@gentoo.org web-apps@gentoo.org jesus.de.santos@gmail.com 2006-10-29 08:15:10 0000 A new version of wordpress is out with lot of bugfixes: http://wordpress.org/development/2006/10/205-ronan/ bathym@0x656d67.org 2006-10-30 01:50:36 0000 Created an attachment (id=100776) wordpress 2.0.5 ebuild dertobi123@gentoo.org 2006-10-30 11:36:12 0000 "The latest in our venerable 2.0 series, which now counts over 1.2 million downloads, is available for download immediately, and we suggest everyone upgrade as this includes security fixes." Re-assigning to security@g.o dertobi123@gentoo.org 2006-10-30 11:41:07 0000 Ok, checking with the fixed bugs in 2.0.5 [1] there seems to be only one security-related [2]. [1] http://trac.wordpress.org/query?status=closed&resolution=fixed&milestone=2.0.5 [2] http://trac.wordpress.org/ticket/2591 jesus.de.santos@gmail.com 2006-10-30 11:44:41 0000 I will try tomorrow. I suppose I need to wait for the rsync servers replication... --------------------------------------- ebuild wordpress-2.0.5.ebuild digest Appending /usr/local to PORTDIR_OVERLAY... >>> Downloading 'http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/distfiles/wordpress-2.0.5.tar.gz' --20:42:52-- http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/distfiles/wordpress-2.0.5.tar.gz => `/usr/portage/distfiles/wordpress-2.0.5.tar.gz' Resolving ftp.belnet.be... 193.190.198.20 Connecting to ftp.belnet.be|193.190.198.20|:80... connected. HTTP request sent, awaiting response... 404 Not Found 20:42:52 ERROR 404: Not Found. frilled@gentoo.org 2006-10-30 21:29:28 0000 Accepting bug; should be at least 3 sec-related fixes, though. Rating B3 for now, mostly for the unserialize() problem - feel free to comment. peter.westwood@ftwr.co.uk 2006-10-31 03:18:56 0000 (In reply to comment #5) > Accepting bug; should be at least 3 sec-related fixes, though. > > Rating B3 for now, mostly for the unserialize() problem - feel free to comment. > The fix for this is also security related - http://trac.wordpress.org/ticket/3142 Although not vulnerable by default as it requires user registration to be enabled you could spy out the metadata of other users (email, etc) including the admin account. jesus.de.santos@gmail.com 2006-11-01 04:40:55 0000 Two days later and wordpress-2.0.5.tar.gz still cannot be found in the mirrors when doing ebuild digest. May be there is something i am doing wrong... peter.westwood@ftwr.co.uk 2006-11-01 05:30:46 0000 (In reply to comment #7) > Two days later and wordpress-2.0.5.tar.gz still cannot be found in the mirrors > when doing ebuild digest. > > May be there is something i am doing wrong... > Yes wordpress-2.0.5.tar.gz will only reach the mirrors once the new ebuild is committed to the tree. jesus.de.santos@gmail.com 2006-11-01 05:48:28 0000 It upgraded nicely from previous version. ---- Portage 2.1.1-r1 (default-linux/x86/2006.0, gcc-4.1.1, glibc-2.4-r3, 2.6.17-gent oo-r8 i686) ================================================================= System uname: 2.6.17-gentoo-r8 i686 Intel(R) Celeron(R) CPU 2.40GHz Gentoo Base System version 1.12.5 Last Sync: Wed, 01 Nov 2006 01:50:01 +0000 app-admin/eselect-compiler: [Not Present] dev-java/java-config: [Not Present] dev-lang/python: 2.3.5-r2, 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: [Not Present] dev-util/confcache: [Not Present] sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.59-r7 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.13-r3 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.17-r1 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-O3 -pipe -march=pentium4 -fomit-frame-pointer" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/NX/etc /usr/NX/home /usr/share/X11/xkb /usr/share/logw atch /var/www/localhost/htdocs/cacti/include" CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo" CXXFLAGS="-O3 -pipe -march=pentium4 -fomit-frame-pointer" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig collision-protect distlocks metadata-transfer sandbox sfper ms strict" GENTOO_MIRRORS="http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/ http://linu v.uv.es/mirror/gentoo/ http://ftp-stud.fht-esslingen.de/pub/Mirrors/gentoo/" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/d istfiles' --exclude='/local' --exclude='/packages'" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage" SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage" USE="x86 X acpi alsa apache2 berkdb bitmap-fonts bzip2 cli cracklib crypt dlload er dri eds elibc_glibc emboss encode fam foomaticdb gdbm gif gnome gstreamer gtk gtk2 iconv imlib input_devices_keyboard input_devices_mouse isdnlog jpeg kernel _linux libg++ libwww mad mikmod mmx motif mp3 mpeg ncurses nls nptl nptlonly ogg pam pcre perl png pppd python qt3 qt4 quicktime readline reflection samba sdl s ession snmp spl sse sse2 ssl svg tiff truetype truetype-fonts type1-fonts udev u sb userland_GNU video_cards_fglrx vorbis xml xorg zlib" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGU AS, PORTAGE_RSYNC_EXTRA_OPTS frilled@gentoo.org 2006-11-06 03:44:05 0000 Anything preventing this from hitting cvs? superlag@gentoo.org 2006-11-07 07:27:07 0000 Time. I just committed it now. frilled@gentoo.org 2006-11-07 08:39:41 0000 Heh, ok .-) Arches, please test & mark stable. jesus.de.santos@gmail.com 2006-11-07 09:14:20 0000 > > Yes > > wordpress-2.0.5.tar.gz will only reach the mirrors once the new ebuild is > committed to the tree. > Already committed and the same problem: >>> Emerging (1 of 1) www-apps/wordpress-2.0.5 to / >>> Downloading 'http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/distfiles/wordpress-2.0.5.tar.gz' --18:11:22-- http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/distfiles/wordpress-2.0.5.tar.gz => `/usr/portage/distfiles/wordpress-2.0.5.tar.gz' Resolving ftp.belnet.be... 193.190.198.20 Connecting to ftp.belnet.be|193.190.198.20|:80... connected. HTTP request sent, awaiting response... 404 Not Found 18:11:22 ERROR 404: Not Found. dertobi123@gentoo.org 2006-11-07 10:27:52 0000 ppc stable superlag@gentoo.org 2006-11-07 10:58:23 0000 I put the tarball on the distfiles-local mirror. It will take a while to propagate to the other mirrors. maekke@gentoo.org 2006-11-07 11:29:47 0000 www-apps/wordpress-2.0.5 USE="-vhosts" 1. emerges on x86 2. passes collision test 3. works Portage 2.1.1-r1 (default-linux/x86/2006.1/desktop, gcc-4.1.1, glibc-2.4-r3, 2.6.17.13 i686) ================================================================= System uname: 2.6.17.13 i686 AMD Athlon(TM) XP1800+ Gentoo Base System version 1.12.6 Last Sync: Tue, 07 Nov 2006 17:50:01 +0000 ccache version 2.3 [enabled] app-admin/eselect-compiler: [Not Present] dev-java/java-config: 1.3.7, 2.0.30 dev-lang/python: 2.3.5-r3, 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: 2.3 dev-util/confcache: [Not Present] sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.60 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.13-r4 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.17-r1 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-O2 -march=i686 -fomit-frame-pointer -pipe" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/" CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo" CXXFLAGS="-O2 -march=i686 -fomit-frame-pointer -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--nospinner" FEATURES="autoconfig ccache collision-protect distlocks fixpackages metadata-transfer parallel-fetch sandbox sfperms strict test userfetch userpriv usersandbox" GENTOO_MIRRORS="http://mirror.switch.ch/mirror/gentoo/ http://gentoo.inode.at/" LANG="en_GB.utf8" LINGUAS="en de en_GB" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage/normal" SYNC="rsync://192.168.2.1/gentoo-portage" USE="x86 3dnow 3dnowext X a52 aac acpi alsa apache2 bash-completion berkdb bitmap-fonts bzip2 cairo cdr cli cracklib crypt css cups dbus divx4linux dlloader dri dts dvd dvdr dvdread elibc_glibc emboss exif fam ffmpeg firefox font-server fortran gdbm gif gnome gphoto2 gpm gstreamer gtk gtk2 gtkhtml hal iconv input_devices_keyboard input_devices_mouse ipv6 isdnlog java jpeg kde kernel_linux ldap libclamav libg++ linguas_de linguas_en linguas_en_GB logitech-mouse mad mikmod mmx mmxext mono mozcalendar mozdevelop mozsvg mp3 mpeg ncurses network nls nptl nptlonly nvidia oav ogg opengl oss pam pcre perl png ppds pppd python qt qt3 qt4 quicktime readline reflection samba sdl seamonkey session spell spl ssl tcltk tcpd test tetex tiff truetype truetype-fonts type1-fonts udev unicode usb userland_GNU vcd video_cards_none video_cards_nv vorbis win32codecs xine xinerama xml xorg xorg-x11 xprint xv xvg xvid zlib" Unset: CTARGET, INSTALL_MASK, LC_ALL, LDFLAGS, MAKEOPTS, PORTAGE_RSYNC_EXTRA_OPTS gustavoz@gentoo.org 2006-11-07 11:43:02 0000 sparc stable. tsunam@gentoo.org 2006-11-07 21:10:18 0000 x86 is stable ^.^ kugelfang@gentoo.org 2006-11-08 09:51:48 0000 Hm, somewhere is a dep on net-www/apache missing. On a fresh stage3, emerge --onlydeps www-apps/wordpress ACCEPT_KEYWORDS="~amd64" emerge "=www-apps/wordpress-2.0.5" yields: * vhosts USE flag not set - auto-installing using webapp-config * This is an installation * wordpress-2.0.5 is not installed - using install mode * Running //usr/sbin/webapp-config -I -h localhost -u root -d /wordpress wordpress 2.0.5 * Fatal error: Your configuration file sets the server type "Apache" * Fatal error: but the corresponding package does not seem to be installed! * Fatal error: Please "emerge >=net-www/apache-1.3" or correct your settings. * Fatal error(s) - aborting Besides that, it works. Stable on amd64. frilled@gentoo.org 2006-11-08 10:19:14 0000 Hm, I'd say you need to configure your webapp-config. At least I hope WordPress runs on others httpds like lightttpd, too ... superlag@gentoo.org 2006-11-08 13:20:45 0000 Per Stuart, this is a webapp-config bug. It should not be checking to see if a specific web server is installed, or not. jer@gentoo.org 2006-11-08 19:21:41 0000 Stable for HPPA. All done. Sorry for the loooong wait. frilled@gentoo.org 2006-11-08 22:36:03 0000 Thanks. SecTeam, review draft please. jaervosz@gentoo.org 2006-11-17 14:36:39 0000 GLSA 200611-10 100776 2006-10-30 01:50 0000 wordpress 2.0.5 ebuild wordpress-2.0.5.ebuild text/plain IyBDb3B5cmlnaHQgMTk5OS0yMDA2IEdlbnRvbyBGb3VuZGF0aW9uCiMgRGlzdHJpYnV0ZWQgdW5k ZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSB2MgojICRIZWFk ZXI6ICQKCmluaGVyaXQgd2ViYXBwIGV1dGlscwoKI1dvcmRwcmVzcyByZWxlYXNlcyBoYXZlIGEg cmVsZWFzZSBuYW1lIHRhZ2dlZCBvbiB0aGUgZW5kIG9mIHRoZSB2ZXJzaW9uIG9uIHRoZSB0YXIu Z3ogZmlsZXMKI01ZX0VYVD0ibWluZ3VzIgoKREVTQ1JJUFRJT049IldvcmRwcmVzcyBwaHAgYW5k IG15c3FsIGJhc2VkIENNUyBzeXN0ZW0uIgpIT01FUEFHRT0iaHR0cDovL3dvcmRwcmVzcy5vcmcv IgojTGF0ZXN0IHZlcnNpb24gaXMgb25seSBhdmFpbGFibGUgaW4gdGhlIGZvcm1hdCEKI0Rvd25s b2FkIGlzIHJlbmFtZWQgYnkgSFRUUCBIZWFkZXIgYXMgd29yZHByZXNzLTx2ZXJzaW9uIG51bWJl cj4udGFyLmd6ClNSQ19VUkk9bWlycm9yOi8vZ2VudG9vLyR7UH0udGFyLmd6CkxJQ0VOU0U9IkdQ TC0yIgpLRVlXT1JEUz0iYW1kNjQgaHBwYSBwcGMgc3BhcmMgeDg2IgpJVVNFPSIiClJERVBFTkQ9 InZpcnR1YWwvaHR0cGQtcGhwCgkgPj1kZXYtZGIvbXlzcWwtMy4yMy4yMyIKCkRFUEVORD0iJHtE RVBFTkR9ICR7UkRFUEVORH0iCgpTPSIke1dPUktESVJ9LyR7UE59IgoKc3JjX3VucGFjaygpIHsK CXVucGFjayAke0F9CiMgbm8gcGF0Y2ggbmVlZGVkIGFueW1vcmUKIwllcGF0Y2ggJHtGSUxFU0RJ Un0vJHtQVn0vbG9naW4tcGF0Y2guZGlmZgp9CgpzcmNfaW5zdGFsbCgpIHsKCWxvY2FsIGRvY3M9 ImxpY2Vuc2UudHh0IHJlYWRtZS5odG1sIgoKCXdlYmFwcF9zcmNfcHJlaW5zdAoKCWVpbmZvICJJ bnN0YWxsaW5nIG1haW4gZmlsZXMiCgljcCAtciAqICR7RH0ke01ZX0hURE9DU0RJUn0KCWVpbmZv ICJEb25lIgoKCWV3YXJuCglld2FybiBQbGVhc2UgbWFrZSBzdXJlIHlvdSBoYXZlIHJlZ2lzdGVy X2dsb2JhbHMgPSBvZmYgc2V0IGluIHlvdXIgL2V0Yy9hcGFjaGUyL3BocC5pbmkgZmlsZQoJZXdh cm4gSWYgdGhpcyBpcyBub3QgYW4gb3B0aW9uIGZvciB5b3VyIHdlYiBzZXJ2ZXIgYW5kIHlvdSBO RUVEIGl0IHNldCB0byBvbiwgdGhlbiBpbnNlcnQgdGhlIGZvbGxvd2luZyBpbiB5b3VyIFdvcmRQ cmVzcyAuaHRhY2Nlc3MgZmlsZToKCWV3YXJuIHBocF9mbGFnIHJlZ2lzdGVyX2dsb2JhbHMgb2Zm Cglld2FybgoKCWV3YXJuCglld2FybiBZb3Ugd2lsbCBuZWVkIHRvIGNyZWF0ZSBhIHRhYmxlIGZv ciB5b3VyIFdvcmRQcmVzcyBkYXRhYmFzZS4gIFRoaXMKCWV3YXJuIGFzc3VtZXMgeW91IGhhdmUg c29tZSBrbm93bGVkZ2Ugb2YgTXlTUUwsIGFuZCBhbHJlYWR5IGhhdmUgaXQKCWV3YXJuIGluc3Rh bGxlZCBhbmQgY29uZmlndXJlZC4gIElmIG5vdCwgcGxlYXNlIHJlZmVyIHRvCglld2FybiB0aGUg R2VudG9vIE15U1FMIGd1aWRlIGF0IHRoZSBmb2xsb3dpbmcgVVJMOgoJZXdhcm4gaHR0cDovL3d3 dy5nZW50b28ub3JnL2RvYy9lbi9teXNxbC1ob3d0by54bWwKCWV3YXJuIExvZyBpbiB0byBNeVNR TCwgYW5kIGNyZWF0ZSBhIG5ldyBkYXRhYmFzZSBjYWxsZWQKCWV3YXJuICJ3b3JkcHJlc3MiLiBG cm9tIHRoaXMgcG9pbnQsIHlvdSB3aWxsIG5lZWQgdG8gZWRpdAoJZXdhcm4geW91ciB3cC1jb25m aWcucGhwIGZpbGUgaW4gJERvY3VtZW50Um9vdC93b3JkcHJlc3MvCglld2FybiBhbmQgcG9pbnQg dG8geW91ciBkYXRhYmFzZS4gT25jZSB0aGlzIGlzIGRvbmUsIHlvdSBjYW4gbG9nIGluIHRvCgll d2FybiBXb3JkUHJlc3MgYXQgaHR0cDovL2xvY2FsaG9zdC93b3JkcHJlc3MKCWV3YXJuCgoJZXdh cm4KCWV3YXJuIElmIHlvdSBhcmUgdXBncmFkaW5nIGZyb20gYSBwcmV2aW91cyB2ZXJzaW9uIEJB Q0sgVVAgeW91cgoJZXdhcm4gZGF0YWJhc2UuICBPbmNlIHlvdSBhcmUgZG9uZSB3aXRoIHRoYXQs IGJyb3dzZSB0bwoJZXdhcm4gaHR0cDovL2xvY2FsaG9zdC93b3JkcHJlc3Mvd3AtYWRtaW4vdXBn cmFkZS5waHAgYW5kIGZvbGxvdwoJZXdhcm4gdGhlIGluc3RydWN0aW9ucyBvbiB0aGUgc2NyZWVu LgoJZXdhcm4KCgkjIGhhbmRsZSBkb2N1bWVudGF0aW9uIGZpbGVzCgkjCgkjIE5PVEUgdGhhdCBk b2MgZmlsZXMgZ28gaW50byAvdXNyL3NoYXJlL2RvYyBhcyBub3JtYWw7IHRoZXkgZG8gTk9UCgkj IGdldCBpbnN0YWxsZWQgcGVyIHZob3N0IQoKCWRvZG9jICR7ZG9jc30KCWZvciBkb2MgaW4gJHtk b2NzfSBJTlNUQUxMOyBkbwoJCXJtIC1mICR7ZG9jfQoJZG9uZQoKCSMgSWRlbnRpZnkgdGhlIGNv bmZpZ3VyYXRpb24gZmlsZXMgdGhhdCB0aGlzIGFwcCB1c2VzCgkjIFVzZXIgY2FuIHdhbnQgdG8g bWFrZSBjaGFuZ2VzIHRvIHRoZXNlIQoJd2ViYXBwX3NlcnZlcm93bmVkICR7TVlfSFRET0NTRElS fS9pbmRleC5waHAKCSN3ZWJhcHBfc2VydmVyb3duZWQgJHtNWV9IVERPQ1NESVJ9L3dwLWxheW91 dC5jc3MKCXdlYmFwcF9zZXJ2ZXJvd25lZCAke01ZX0hURE9DU0RJUn0vd3AtYWRtaW4vbWVudS5w aHAKCXdlYmFwcF9zZXJ2ZXJvd25lZCAke01ZX0hURE9DU0RJUn0KCgkjIElkZW50aWZ5IGFueSBz Y3JpcHQgZmlsZXMgdGhhdCBuZWVkICMhIGhlYWRlcnMgYWRkaW5nIHRvIHJ1biB1bmRlcgoJIyBh IENHSSBzY3JpcHQgKHN1Y2ggYXMgUEhQL0NHSSkKCSMKCSMgZm9yIHdvcmRwcmVzcywgd2UgKmFz c3VtZSogdGhhdCBhbGwgLnBocCBmaWxlcyBuZWVkIHRvIGhhdmUgQ0dJL0JJTgoJIyBzdXBwb3J0 IGFkZGVkCgoJIyBwb3N0LWluc3RhbGwgaW5zdHJ1Y3Rpb25zCgkjd2ViYXBwX3Bvc3RpbnN0X3R4 dCBlbiAke0ZJTEVTRElSfS8xLjIvcG9zdGluc3RhbGwtZW4udHh0CgoJIyBub3cgc3RydXQgc3R1 ZmYKCXdlYmFwcF9zcmNfaW5zdGFsbAoKfQo=