Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 636336 (CVE-2017-16510)

Summary: <www-apps/wordpress-4.8.3: SQL Injection vulnerability
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: trivial CC: web-apps
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/
Whiteboard: ~4 [noglsa cve]
Package list:
Runtime testing required: ---

Description GLSAMaker/CVETool Bot gentoo-dev 2017-11-03 01:36:13 UTC 
CVE-2017-16510 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-16510):
  WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can
  create unexpected and unsafe queries leading to potential SQL injection
  (SQLi) in plugins and themes, as demonstrated by a "double prepare"
  approach, a different vulnerability than CVE-2017-14723.
Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-11-03 01:37:25 UTC 
@Maintainers please let us know when tree is clean from vulnerable versions.

Thank you