Description
The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls.
Analysis and contextual insights are available on OpenCVE Cloud.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-2670-1 | wordpress security update |
EUVD |
EUVD-2011-4864 | The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls. |
References
History
No history.
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-09-17T03:44:06.481Z
Reserved: 2011-12-23T00:00:00.000Z
Link: CVE-2011-4957
No data.
Status : Modified
Published: 2012-06-27T21:55:02.360
Modified: 2026-04-29T01:13:23.040
Link: CVE-2011-4957
No data.
OpenCVE Enrichment
No data.
Weaknesses
Debian DSA
EUVD