wordpress (3.8.2+dfsg-1ubuntu0.1) trusty-security; urgency=medium

  * SECURITY UPDATE: upstream security and bug fixes (LP: #1395336):
    - 3.8.3:
      - Post collision bug fix (wp-admin/includes/post.php)
    - 3.8.4:
      - CVE-2014-2053 (wp-includes/ID3/getid3.lib.php)
      - CVE-2014-5265 CVE-2014-5266 (wp-includes/class-IXR.php)
      - CVE-2014-5204 CVE-2014-5205 CVE-2014-5240 (wp-includes/pluggable.php)
      - Constant time wp_verify_nonce (wp-includes/compat.php)
    - 3.8.5:
      - three cross-site scripting issues
      - cross-site request forgery to trigger password change
      - DoS when passwords are checked
      - protections against server-side request forgery attacks
      - hash collision on pre-2008 logins
      - invalidate links from password reset emails after use

 -- Kees Cook <kees@ubuntu.com>  Sat, 22 Nov 2014 07:50:29 -0800

wordpress (3.8.2+dfsg-1) unstable; urgency=high

  * New upstream release Fixes CVE-2014-0165, CVE-2014-0166
    and Closes: #744019

 -- Craig Small <csmall@debian.org>  Wed, 09 Apr 2014 22:13:54 +1000

wordpress (3.8.1+dfsg1-2) unstable; urgency=medium

  * Updated copyright file Closes: #736514

 -- Craig Small <csmall@debian.org>  Fri, 14 Feb 2014 22:03:49 +1100

wordpress (3.8.1+dfsg1-1) unstable; urgency=medium

  * Added Breaks/Replaces for combined wordpress Closes: #736688
  * Removed moxieplayer.swf and added missing sources Closes: #736804

 -- Craig Small <csmall@debian.org>  Thu, 06 Feb 2014 22:42:07 +1100

wordpress (3.8.1+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Depend on either mysql or mariadb client Closes: #732914

 -- Craig Small <csmall@debian.org>  Fri, 24 Jan 2014 22:20:08 +1100

wordpress (3.8+dfsg-1) unstable; urgency=low

  [ Pablo Vazquez Martinez ]
  * Split themes in different binary packages. Closes: #723819

  [ Craig Small ]
  * New upstream release. Closes: #733726
  * Update Standards-Version to 3.9.5.
  * New Maintainer

 -- Craig Small <csmall@debian.org>  Wed, 22 Jan 2014 22:28:02 +1100

wordpress (3.7.1+dfsg-1) unstable; urgency=low

  * New upstream release.
  * Enable usage of php5-mysqlnd as an alternative to php5-mysql.
    Closes: #722552
  * Improve wp-setup to cope with plugins/themes directories with
    spaces. Thanks to Oskar Liljeblad <oskar@osk.mine.nu> for the patch.
    Closes: #723074
  * Refresh patches

 -- Raphaël Hertzog <hertzog@debian.org>  Wed, 13 Nov 2013 20:41:09 +0100

wordpress (3.6.1+dfsg-1) unstable; urgency=high

  * New upstream security release. Fixes CVE-2013-4338 CVE-2013-4339
    CVE-2013-4340. Closes: #722537

 -- Raphaël Hertzog <hertzog@debian.org>  Thu, 12 Sep 2013 07:58:57 +0200

wordpress (3.6+dfsg-1) unstable; urgency=low

  * New upstream release.
  * Improve wp-settings to verify that $_SERVER['HTTP_X_FORWARDED_PROTO']
    exists before accessing it (avoids a PHP notice).
    Thanks to Paul Dreik <slask@pauldreik.se> for the report and the patch.
  * Document in README.Debian the need to login to /wp-admin/ to complete
    an upgrade.
  * Drop useless debian/README.source
  * Drop 008CVE2008-2392.patch since upstream now disables unfiltered
    uploads by default. See http://core.trac.wordpress.org/ticket/10692
  * Drop 009CVE2008-6767.patch since the backto parameter is validated
    against a whitelist, and externally triggered upgrades are not a
    security problem as long as they work.
  * Update debian/missing-sources with latest versions.
  * Update upstream l10n.

 -- Raphaël Hertzog <hertzog@debian.org>  Wed, 04 Sep 2013 23:18:58 +0200

wordpress (3.5.2+dfsg-1) unstable; urgency=low

  * New upstream release with many security fixes. Closes: #713947
    * Server-Side Request Forgery (SSRF) via the HTTP API. CVE-2013-2199.
    * Privilege Escalation: Contributors can publish posts, and users can
      reassign authorship. CVE-2013-2200.
    * Cross-Site Scripting (XSS) in SWFUpload. CVE-2013-2205.
    * Denial of Service (DoS) via Post Password Cookies. CVE-2013-2173.
    * Content Spoofing via Flash Applet in TinyMCE Media Plugin.
      CVE-2013-2204.
    * Cross-Site Scripting (XSS) when Uploading Media. CVE-2013-2201.
    * Full Path Disclosure (FPD) during File Upload. CVE-2013-2203.
  * Additional security hardening includes:
    * Cross-Site Scripting (XSS) (Low Severity) when Editing Media.
      CVE-2013-2201.
    * Cross-Site Scripting (XSS) (Low Severity) when Installing/Updating
      Plugins/Themes. CVE-2013-2201.
    * XML External Entity Injection (XXE) via oEmbed. CVE-2013-2202.
  * Update the Vcs-Git and Vcs-Browser URLs.
  * Update Standards-Version to 3.9.4.

 -- Raphaël Hertzog <hertzog@debian.org>  Tue, 25 Jun 2013 15:52:07 +0200

# For older changelog entries, run 'apt-get changelog wordpress-theme-twentytwelve'
