====================================================================

                                      CERT-Renater

                            Note d'Information No. 2012/VULN195
____________________________________________________________________

DATE                : 23/04/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running WordPress versions prior to 3.3.2,
                                            3.4 Beta 3.

======================================================================
http://wordpress.org/news/2012/04/wordpress-3-3-2/
______________________________________________________________________

WordPress 3.3.2 (and WordPress 3.4 Beta 3)

Posted April 20, 2012 by Andrew Nacin. Filed under Development, Releases,
Security.

WordPress 3.3.2 is available now and is a security update for all previous
versions.

Three external libraries included in WordPress received security updates:

Plupload (version 1.5.4), which WordPress uses for uploading media.
SWFUpload, which WordPress previously used for uploading media, and may
still be in use by plugins.
SWFObject, which WordPress previously used to embed Flash content, and
may still be in use by plugins and themes.

Thanks to Neal Poole and Nathan Partlan for responsibly disclosing the
bugs in Plupload and SWFUpload, and Szymon Gruszecki for a separate bug
in SWFUpload.

WordPress 3.3.2 also addresses:

Limited privilege escalation where a site administrator could deactivate
network-wide plugins when running a WordPress network under particular
circumstances, disclosed by Jon Cave of our WordPress core security team,
and Adam Backstrom.

Cross-site scripting vulnerability when making URLs clickable, by Jon Cave.

Cross-site scripting vulnerabilities in redirects after posting comments
in older browsers, and when filtering URLs. Thanks to Mauro Gentile for
responsibly disclosing these issues to the security team.

These issues were fixed by the WordPress core security team. Five other
bugs were also fixed in version 3.3.2. Consult the change log for more
details.

Download WordPress 3.3.2 or update now from the Dashboard → Updates menu
in your site’s admin area.

WordPress 3.4 Beta 3 also available
Our development of WordPress 3.4 development continues. Today we are
proud to release Beta 3 for testing. Nearly 90 changes have been made
since Beta 2, released 9 days ago. (We are aiming for a beta every week.)

This is still beta software, so we don’t recommend that you use it on
production sites. But if you’re a plugin developer, a theme developer,
or a site administrator, you should be running this on your test
environments and reporting any bugs you find. (See the known issues here.)
If you’re a WordPress user who wants to open your presents early,
take advantage of WordPress’s famous 5-minute install and spin up a
secondary test site. Let us know what you think!

Version 3.4 Beta 3 includes all of the fixes included in version 3.3.2.
Download WordPress 3.4 Beta 3 or use the WordPress Beta Tester plugin.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================