-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 3.0 (quilt) Source: wordpress Binary: wordpress, wordpress-l10n, wordpress-theme-twentyfourteen, wordpress-theme-twentythirteen, wordpress-theme-twentytwelve Architecture: all Version: 4.0.1+dfsg-1 Maintainer: Craig Small <[email protected]> Homepage: http://wordpress.org Standards-Version: 3.9.5 Vcs-Browser: http://anonscm.debian.org/gitweb/?p=collab-maint/wordpress.git Vcs-Git: git://anonscm.debian.org/collab-maint/wordpress.git Build-Depends: debhelper (>= 9), dh-linktree Build-Depends-Indep: gettext, libjs-backbone, libjs-cropper, libjs-jquery (>= 1.6.1), libjs-jquery-form, libjs-jquery-ui (>= 1.8.1), libjs-prototype, libjs-scriptaculous, libjs-swfobject, libjs-underscore, libphp-phpmailer (>= 5.1), libphp-simplepie (>= 1.2), libphp-snoopy, perl, tinymce (>= 3.4.2) Package-List: wordpress deb web optional arch=all wordpress-l10n deb localization optional arch=all wordpress-theme-twentyfourteen deb web optional arch=all wordpress-theme-twentythirteen deb web optional arch=all wordpress-theme-twentytwelve deb web optional arch=all Checksums-Sha1: c23e3f0af7957f31de78d002290dc067ca536bd6 4767212 wordpress_4.0.1+dfsg.orig.tar.xz 58bdb60bdd50b166a98be6f9315af56f7fb2e035 5234184 wordpress_4.0.1+dfsg-1.debian.tar.xz Checksums-Sha256: 01dd39c08137252ddd9adf8b87bb0a2175404b4ac04568724aa4fbe5600c086b 4767212 wordpress_4.0.1+dfsg.orig.tar.xz 641779f1defc66e6a3f289eca3af6008ee59b5f7fd5acb1377d6a998d5184b9c 5234184 wordpress_4.0.1+dfsg-1.debian.tar.xz Files: f152c306a54fa3b7dd58d8e46cc9edc9 4767212 wordpress_4.0.1+dfsg.orig.tar.xz 70321179ecee0a74806d5ffde34b84fc 5234184 wordpress_4.0.1+dfsg-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJUcEq7AAoJEDk4+WvfUP6l2A4P/ih9oG+5gDUGGVDZ/vRpUTlG gVN0lVb4AMpGLX0UXyHJUGILs+jA0asLz6NmpMMhSKcpsT9LMUMLfZVW//9UmMEp ExtIaMPuYYyo3W4EIo9GxvG2aGG5B6tPn22q4lXWJlWJpYB1P8TkyxfyPrTVKX5s r4uFt+TKwcJXseMrk8+/3IGL2WLSn9I9+1NH+62muDa8tZWtAFb8P25L/9Yw2zWn +qODDQEitEm9Xck5m1l48kyjInvcswek+TceFNDVUGGerr5QaPaWHvStN5tkLnNa p2uSaJenv6MhMzRg+EMbtpkG8Kkr3QVeRUZSgBoMsdkKnMF3IfEkmCnYKcUPOqEx tPLWjJQZmrVaWgdV6uW8JMhpcChWeLDENBqjStx1XI09WpAsLxPwr2uKc8c8yGBG cEuEo1DzMDRszlhzZ1XyOEtgL7n29VXHNCvqHqFqSST3pbl4utztLC1q8Zsh2UDF PGGL2uSi/+qD8j/ZteOtlo1aaPt5C59IZvFB6fI2ay6eqdvsf6mPXezxLv5X8Iz7 ImH6RFGzpPl0YSqjSeqG8v6eLPkAyAfXXj24dNldHV+m/F4WBIKIzzGsElXDsiER SQPRJEKbJlgIWDV8EQ4gnmD6Y3nIQtc4uB0Sod70wtSzNK+HKYen44a/fkVjkWsx YtjTU3iHfVYROmRMG2Iz =YRtf -----END PGP SIGNATURE----- Changes: wordpress (4.0.1+dfsg-1) unstable; urgency=high * New upstream release * Fixes several security bugs Closes: #770425 - Three cross-site scripting issues that a contributor or author could use to compromise a site. - A cross-site request forgery that could be used to trick a user into changing their password. - An issue that could lead to a denial of service when passwords are checked. - Additional protections for server-side request forgery attacks when WordPress makes HTTP requests. - An extremely unlikely hash collision could allow a user’s account to be compromised, that also required that they haven’t logged in since 2008. - WordPress now invalidates the links in a password reset email if the user remembers their password, logs in, and changes their email address. -- Craig Small <[email protected]> Sat, 22 Nov 2014 19:29:37 +1100
