{"id":3269,"date":"2014-08-06T19:04:27","date_gmt":"2014-08-06T19:04:27","guid":{"rendered":"http:\/\/wordpress.org\/news\/?p=3269"},"modified":"2021-06-04T12:01:03","modified_gmt":"2021-06-04T12:01:03","slug":"wordpress-3-9-2","status":"publish","type":"post","link":"https:\/\/wordpress.org\/news\/2014\/08\/wordpress-3-9-2\/","title":{"rendered":"WordPress 3.9.2 Security Release"},"content":{"rendered":"<p>WordPress 3.9.2 is now available as a security release for all previous versions.\u00a0We strongly encourage you to update your sites immediately.<\/p>\n<p>This release fixes a possible denial of service issue in PHP&#8217;s XML processing, reported by <a href=\"https:\/\/twitter.com\/nirgoldshlager\">Nir Goldshlager<\/a> of the Salesforce.com Product Security Team. It\u00a0\u00a0was fixed by Michael Adams and Andrew Nacin of the WordPress security team and\u00a0David Rothstein of the <a href=\"https:\/\/www.drupal.org\/SA-CORE-2014-004\">Drupal security team<\/a>. This is the first time our two projects have coordinated joint security releases.<\/p>\n<p>WordPress 3.9.2 also contains other security changes:<\/p>\n<ul>\n<li>Fixes a possible but unlikely code execution when processing widgets (WordPress is not affected by default), discovered by <a href=\"http:\/\/www.buayacorp.com\/\">Alex Concha<\/a> of the WordPress security team.<\/li>\n<li>Prevents information disclosure via XML entity attacks in the external GetID3 library, reported by <a href=\"http:\/\/onsec.ru\/en\/\">Ivan Novikov<\/a>\u00a0of ONSec.<\/li>\n<li>Adds protections against brute attacks against CSRF tokens, reported by <a href=\"http:\/\/systemoverlord.com\/\">David Tomaschik<\/a> of the Google Security Team.<\/li>\n<li>Contains some additional security hardening, like preventing cross-site scripting that could be triggered only by administrators.<\/li>\n<\/ul>\n<p>We appreciated responsible disclosure of these issues directly to our security team. For more information, see the <a href=\"https:\/\/codex.wordpress.org\/Version_3.9.2\">release notes<\/a> or consult the <a href=\"https:\/\/core.trac.wordpress.org\/log\/branches\/3.9?stop_rev=29383&amp;rev=29411\">list of changes<\/a>.<\/p>\n<p><a href=\"https:\/\/wordpress.org\/download\/\">Download WordPress 3.9.2<\/a> or venture over to <strong>Dashboard \u2192 Updates<\/strong> and simply click &#8220;Update Now&#8221;.<\/p>\n<p>Sites that support automatic background updates will be updated to WordPress 3.9.2 within 12 hours. (If you are still on WordPress 3.8.3 or 3.7.3, you will also be updated to 3.8.4 or 3.7.4. We don&#8217;t support older versions, so please update to 3.9.2 for the latest and greatest.)<\/p>\n<p>Already testing WordPress 4.0? The third beta is <a href=\"https:\/\/wordpress.org\/wordpress-4.0-beta3.zip\">now available<\/a> (zip) and it contains these security fixes.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress 3.9.2 is now available as a security release for all previous versions.\u00a0We strongly encourage you to update your sites immediately. This release fixes a possible denial of service issue in PHP&#8217;s XML processing, reported by Nir Goldshlager of the Salesforce.com Product Security Team. It\u00a0\u00a0was fixed by Michael Adams and Andrew Nacin of the WordPress [&hellip;]<\/p>\n","protected":false},"author":5286302,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"episode_type":"","audio_file":"","cover_image":"","cover_image_id":"","duration":"","filesize":"","date_recorded":"","explicit":"","block":"","filesize_raw":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[14,15],"tags":[166],"class_list":["post-3269","post","type-post","status-publish","format-standard","hentry","category-releases","category-security","tag-3-9"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pZhYe-QJ","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/3269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/users\/5286302"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/comments?post=3269"}],"version-history":[{"count":9,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/3269\/revisions"}],"predecessor-version":[{"id":3278,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/3269\/revisions\/3278"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/media?parent=3269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/categories?post=3269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/tags?post=3269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}