SQL injection vulnerability in wp-includes/query.php in WordPress CVE-2007-6318

debdiff ready.

<email address hidden> Notified.

Response:

Thijs Kinkhorst <email address hidden>

Thanks for keeping us in the loop, I've noted this patch in our tracker
and it will probably be used for addressing the issue in Debian.

Thijs

Please apply patch on <=gutsy
hardy use 2.3.2-1ubuntu1 and this version it'snt vulnerable.

dapper not affected.

Edgy not affected.

cleaned debdiff attached

cleaned debdiff attached

I am unable to apply these debdiffs:

$ cat /tmp/gutsy_wordpress_2.2.2-1ubuntu1.2.debdiff | patch -p1
patching file debian/changelog
patch: **** malformed patch at line 15: wordpress (2.2.2-1ubuntu1.1) gutsy-security; urgency=low

$ cat /tmp/feisty_wordpress_2.1.3-1ubuntu1.1.debdiff | patch -p1
patching file debian/changelog
patch: **** malformed patch at line 15: wordpress (2.1.3-1ubuntu1) feisty; urgency=low

Can you regenerate the debdiffs and also update the changelog to use https://wiki.ubuntu.com/SecurityUpdateProcedures, point '5' of 'Preparing an Update'.

Thanks for your hard work on this!

ok, debdiff to gutsy reviewed.
Now ready for upload

+wordpress (2.2.2-1ubuntu1.2) gutsy-security; urgency=low
+
+ * SECURITY UPDATE:
+ - SQL injection vulnerability in wp-includes/query.php
+ * References
+ - http://trac.wordpress.org/ticket/5487
+ - CVE-2007-6318 (LP: #181416)
+ * NON-Security fix
+ - blogroll fix in wp-admin/upgrade-functions.php
+ changed Planet Debian to Planet Ubuntu
+
+ -- Emanuele Gentili <email address hidden> Tue, 22 Jan 2008 18:34:21 +0100

added little fix to blogroll default items.

ok, debdiff to feisty reviewed too.
Now ready for upload

+wordpress (2.1.3-1ubuntu1.1) feisty-security; urgency=low
+
+ * SECURITY UPDATE:
+ - SQL injection vulnerability in wp-includes/query.php
+ * References
+ - http://trac.wordpress.org/ticket/5487
+ - CVE-2007-6318 (LP: #181416)
+
+ -- Emanuele Gentili <email address hidden> Tue, 22 Jan 2008 19:48:59 +0100
+

As stated, Hardy is not vulnerable.

The changelog says "SQL injection", but it is just an admin test failure to see unpublished posts. I've adjusted the changelog to follow the SUP more closely. The changes are building now and should be published shortly. Thanks for the fixed debdiffs!

Of course, because the fix is completely irrelevent to CVS-2007-6318, which is not fixed even after WordPress 2.3.3. The fix is against another vuln instead:

http://xforce.iss.net/xforce/xfdb/39409

I don't know how wrong and how far does this advisory go though.