On June 27, 2012, WordPress 3.4.1 was released to the public. This is a maintenance and security update.

[Karma Dorje]

http://codex.wordpress.org/Version_3.4.1

Lists several security issues as corrected:

-Privilege Escalation/XSS. Critical. Administrators and editors in
multisite were accidentally allowed to use unfiltered_html for 3.4.0.
-CSRF. Additional CSRF protection in the customizer.
-Information Disclosure: Disclosure of post contents to authors and
contributors (such as private or draft posts).
-Hardening: Deprecate wp_explain_nonce(), which could reveal
unnecessary information.
-Hardening: Require a child theme to be activated with its intended
parent only.

[Raphaël Hertzog (hertzog)]

On Tue, 03 Jul 2012, karma wrote:
> http://codex.wordpress.org/Version_3.4.1

I already packaged Wordpress 3.4.1 for Debian. It will hit unstable
the next week-end (I wanted to wait until 3.4 had transitioned to
testing).

After that it will be auto-imported into Quantal.

Cheers,
--
Raphaël Hertzog ◈ Debian Developer

Get the Debian Administrator's Handbook:
→ http://debian-handbook.info/get/

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Jeremy Bícha (jbicha)]

WordPress 3.4.1 has been synced to Ubuntu 12.10 Alpha "Quantal Quetzal".