CVE-2013-1464

NameCVE-2013-1464
DescriptionCross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the playerID parameter.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-2772-1
NVD severitymedium (attack range: remote, user-initiated)
Debian/oldstablepackage typo3-src is vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot known to be vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
typo3-src (PTS)squeeze (security), squeeze4.3.9+dfsg1-1+squeeze9vulnerable
wheezy4.5.19+dfsg1-5+wheezy3fixed
wheezy (security)4.5.19+dfsg1-5+wheezy4fixed
sid4.5.40+dfsg1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
typo3-srcsource(unstable)4.5.29+dfsg1-1medium
typo3-srcsourcesqueeze(unfixed)end-of-life
typo3-srcsourcewheezy4.5.19+dfsg1-5+wheezy1mediumDSA-2772-1

Notes

[squeeze] - typo3-src <end-of-life> (Unsupported in squeeze-lts)

Search for package or bug name: Reporting problems