full-disclosure - Re: [SECURITY] [DSA 1792-1] New drupal6 packages fix multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 9 May 2009 12:46:23 -0700 (PDT)
From: Kennith Greenwood <nitroduckracer@...global.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [SECURITY] [DSA 1792-1] New drupal6 packages
	fix multiple vulnerabilities

Please stop sending Emails to me.And if you can get me off this Full Disclosure mailing.Twenty to thirty Emails a day is ridiculous.PLEASE ,PLEASE,PLEASE STOP!!!!!!!!!!!!

________________________________
From: Noah Meyerhans <noahm@...ian.org>
To: Debian Security Announce <debian-security-announce@...ts.debian.org>
Sent: Wednesday, May 6, 2009 10:54:22 AM
Subject: [Full-disclosure] [SECURITY] [DSA 1792-1] New drupal6 packages fix multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1792-1                security@...ian.org
http://www.debian.org/security/                        Noah Meyerhans
May 06, 2009                        http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : drupal6
Vulnerability  : multiple
Problem type  : remote
Debian-specific: no
Debian Bug    : 526378

Multiple vulnerabilities have been discovered in drupal, a web content
management system.

pod.Edge discovered a cross-site scripting vulnerability due that can be
triggered when some browsers interpret UTF-8 strings as UTF-7 if they
appear before the generated HTML document defines its Content-Type.
This allows a malicious user to execute arbitrary javascript in the
context of the web site if they're allowed to post content.

Moritz Naumann discovered an information disclosure vulnerability.  If
a user is tricked into visiting the site via a specially crafted URL
and then submits a form (such as the search box) from that page, the
information in their form submission may be directed to a third-party
site determined by the URL and thus disclosed to the third party. The
third party site may then execute a cross-site request forgery attack
against the submitted form.

For the stable distribution (lenny), these problems have been fixed in version
6.6-3lenny1.

The old stable distribution (etch) does not contain drupal and is not
affected.

For the unstable distribution (sid), these problems have been fixed in
version 6.11-1

We recommend that you upgrade your drupal6 package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/d/drupal6/drupal6_6.6-3lenny1.dsc
    Size/MD5 checksum:    1124 bedc53674c2746aa0172ba085ee49cf7
  http://security.debian.org/pool/updates/main/d/drupal6/drupal6_6.6.orig.tar.gz
    Size/MD5 checksum:  1071507 caaa55d1990b34dee48f5047ce98e2bb
  http://security.debian.org/pool/updates/main/d/drupal6/drupal6_6.6-3lenny1.diff.gz
    Size/MD5 checksum:    19809 907241818d13cff27fd8eb8487002ad6

Architecture independent packages:

  http://security.debian.org/pool/updates/main/d/drupal6/drupal6_6.6-3lenny1_all.deb
    Size/MD5 checksum:  1083398 0f30de9089c576ecdb85acf8e71e87a3

  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKAbI8YrVLjBFATsMRAqhzAJoCMY3Y8IiuvCrIjqZIwY8n/x9NewCgisaL
ji5qVBsBZ6frrXsksydMf2o=
=yG9u
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/