What’s the Security Update in WordPress 4.2.4
On August 4, WordPress 4.2.4 was released to the public. This is a security update for all previous WordPress versions.This security release addresses six vulnerabilities and four bugs.
Summary
According to the release notes, WordPress 4.2.4 patches three cross-site scripting (XSS) flaws and a SQL injection vulnerability that can be exploited to compromise websites. The latest version also protects users against a potential timing side-channel attack, and prevents attackers from locking posts from being edited.
Marc-Alexandre Montpas of Sucuri, Helen Hou-Sandí of the WordPress security team, Netanel Rubin of Check Point, Ivan Grigorov, Johannes Schmitt of Scrutinizer, and Mohamed A. Baset have been credited for reporting these vulnerabilities.
WordPress has noted that these fixes are also included in WordPress 4.3 RC2.
Check Point has published a brief advisory for the SQL injection vulnerability (CVE-2015-2213) patched in the latest version of WordPress. According to the security firm, this is a critical flaw affecting WordPress 4.2.3 and prior.
“An SQL injection vulnerability has been reported in WordPress Comments. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system,” reads the advisory from Check Point.
In addition to the security fixes, WordPress 4.2.4 contains fixes for 4 bugs from 4.2.3, including:
- FIX - WPDB: When checking the encoding of strings against the database, make sure we’re only relying on the return value of strings that were sent to the database.
- FIX - Don’t blindly trust the output of glob() to be an array.
- FIX - Shortcodes: Handle do_shortcode('<[shortcode]') edge cases.
- FIX - Shortcodes: Protect newlines inside of CDATA.
List of Files Revised
readme.html wp-admin/about.php wp-admin/includes/class-wp-upgrader.php wp-admin/includes/post.php wp-admin/includes/update-core.php wp-admin/js/nav-menu.js wp-admin/js/nav-menu.min.js wp-admin/post.php wp-includes/class-wp-customize-widgets.php wp-includes/class-wp-embed.php wp-includes/default-widgets.php wp-includes/formatting.php wp-includes/l10n.php wp-includes/post.php wp-includes/shortcodes.php wp-includes/theme.php wp-includes/version.php wp-includes/wp-db.php
