bugtraq - [SECURITY] [DSA 2913-1] drupal7 security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 25 Apr 2014 20:17:56 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 2913-1] drupal7 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2913-1                   security@...ian.org
http://www.debian.org/security/                      Salvatore Bonaccorso
April 25, 2014                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : drupal7
CVE ID         : CVE-2014-2983

An information disclosure vulnerability was discovered in Drupal, a
fully-featured content management framework. When pages are cached for
anonymous users, form state may leak between anonymous users. Sensitive
or private information recorded for one anonymous user could thus be
disclosed to other users interacting with the same form at the same
time.

This security update introduces small API changes, see the upstream
advisory at https://drupal.org/SA-CORE-2014-002 for further information.

For the stable distribution (wheezy), this problem has been fixed in
version 7.14-2+deb7u4.

For the testing distribution (jessie), this problem has been fixed in
version 7.27-1.

For the unstable distribution (sid), this problem has been fixed in
version 7.27-1.

We recommend that you upgrade your drupal7 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJTWsKlAAoJEAVMuPMTQ89EuQQQAIaTKR7e4si6wHYA7IK0jDgE
KuukKyrRhWghAZSLTyvNoRAAGL+Ay9tTj67T5jtNQ5RSpZ9fMgb4Q/GPqpp/Lkr3
tkENeFHlGXszQFyg7JZ1KCc+rvNTncESWC0auad/kGNURdvWgpSvofuyLcobEnPV
Ga6uyVFeFLfUfNZUWOQAA7ujHx4BtGXwEb+snJhyiFYVm8GhBfD0Viwzdn6AqLG9
mTadwarYjLBnvvOO5AInXpqGfGUDYrsv9UfbY1gdZFm2TLWvgj4ZRPPczbclms1f
rXKl4SIsyFOBsPm1nfaZ8equFui+zOZjX63awqWHn1qY3tu0KWVom6RxdKmwrSHx
iGkX/cLbHJFr2HxSgbbnQd4TmhcMm/5gJa103ZvLfMYbhugAGXNaPj+ffi4wtYb9
Z3TAB6LWEfrOUeoFCFLAmSo23JyhFIGHoC58FSEw0LmbePc+zP5vIbyEKAy1FE6I
ia7D/ljfV85aloicbuoWIbdgJztlDx2oj4pYugJF1Xg9R2AQKtmubbJG//j+n3pV
2d1TxQye4hBijxDkdSwKKoezW/1hgplRLeyIVFEb/gwZyoyNQuVJCpr4UBKca+98
YBDjqsiFoLtorXnY0Nmz1i7h6VkR1qr+gT6tBg352wLCU8exLqBl+zBluke6TacX
lYsr0BeDNSniXKQ/VGue
=d/kF
-----END PGP SIGNATURE-----