Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 636336 (CVE-2017-16510) - <www-apps/wordpress-4.8.3: SQL Injection vulnerability
Summary: <www-apps/wordpress-4.8.3: SQL Injection vulnerability
Status: RESOLVED FIXED
Alias: CVE-2017-16510
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial
Assignee: Gentoo Security
URL: https://wordpress.org/news/2017/10/wo...
Whiteboard: ~4 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-11-03 01:36 UTC by GLSAMaker/CVETool Bot
Modified: 2018-01-25 21:12 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2017-11-03 01:36:13 UTC 
CVE-2017-16510 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-16510):
  WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can
  create unexpected and unsafe queries leading to potential SQL injection
  (SQLi) in plugins and themes, as demonstrated by a "double prepare"
  approach, a different vulnerability than CVE-2017-14723.
Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-11-03 01:37:25 UTC 
@Maintainers please let us know when tree is clean from vulnerable versions.

Thank you