| |||||||||||||||||||
Fedora alert FEDORA-2009-7362 (drupal)
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-7362 2009-07-03 18:38:42 -------------------------------------------------------------------------------- Name : drupal Product : Fedora 9 Version : 6.13 Release : 1.fc9 URL : http://www.drupal.org Summary : An open-source content-management platform Description : Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure. -------------------------------------------------------------------------------- Update Information: Fixes SA-CORE-2009-007 ( http://drupal.org/node/507572 ). Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script. Multiple vulnerabilities and weaknesses were discovered in Drupal. Cross-site scripting The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS). This issue affects Drupal 6.x only. Input format access bypass User signatures have no separate input format, they use the format of the comment with which they are displayed. A user will no longer be able to edit a comment when an administrator changes the comment's input format to a format that is not accessible to the user. However they will still be able to modify their signature, which will then be processed by the new input format. If the new format is very permissive, via their signature, the user may be able to insert arbitrary HTML and script code into pages or, when the PHP filter is enabled for the new format, execute PHP code. This issue affects Drupal 6.x only. Password leaked in URL When an anonymous user fails to login due to mistyping his username or password, and the page he is on contains a sortable table, the (incorrect) username and password are included in links on the table. If the user visits these links the password may then be leaked to external sites via the HTTP referer. In addition, if the anonymous user is enticed to visit the site via a specially crafted URL while the Drupal page cache is enabled, a malicious user might be able to retrieve the (incorrect) username and password from the page cache. This issue affects both Drupal 5.x and Drupal 6.x -------------------------------------------------------------------------------- ChangeLog: * Thu Jul 2 2009 Jon Ciesla <limb@jcomserv.net> - 6.13-1 - Update to 6.11, SA-CORE-2009-007. - Added clarifying text on module installation to readme, BZ 500707. * Thu May 14 2009 Jon Ciesla <limb@jcomserv.net> - 6.12-1 - Update to 6.11, SA-CORE-2009-006. * Thu Apr 30 2009 Jon Ciesla <limb@jcomserv.net> - 6.11-1 - Update to 6.11, SA-CORE-2009-005. * Mon Apr 27 2009 Jon Ciesla <limb@jcomserv.net> - 6.10-2 - Added SELinux/sendmail note to README, BZ 497642. * Thu Feb 26 2009 Jon Ciesla <limb@jcomserv.net> - 6.10-1 - Update to 6.10, SA-CORE-2009-003. * Tue Feb 17 2009 Jon Ciesla <limb@jcomserv.net> - 6.9-2 - Drop pre script for files move, 472642. - Updated drupal-README.fedora. - Mark cron job noreplace, BZ 485567. * Thu Jan 15 2009 Jon Ciesla <limb@jcomserv.net> - 6.9-1 - Upgrade to 6.9, SA-CORE-2009-001. * Fri Jan 2 2009 Jon Ciesla <limb@jcomserv.net> - 6.8-1 - Upgrade to 6.8. - Move files directories from sites to /var/lib/drupal/files/N for selinux reasons, 472642. - Included script to move files outside of default, use at your own risk, patches welcome. * Thu Dec 11 2008 Jon Ciesla <limb@jcomserv.net> - 6.7-1 - Upgrade to 6.7, SA-2008-073. * Wed Oct 22 2008 Jon Ciesla <limb@jcomserv.net> - 6.6-1 - Upgrade to 6.6, SA-2008-067. * Thu Oct 9 2008 Jon Ciesla <limb@jcomserv.net> - 6.5-1 - Upgrade to 6.5, SA-2008-060. - Added notes to README and drupal.conf re CVE-2008-3661. * Thu Aug 14 2008 Jon Ciesla <limb@jcomserv.net> - 6.4-1 - Upgrade to 6.4, SA-2008-047. * Thu Jul 10 2008 Jon Ciesla <limb@jcomserv.net> - 6.3-1 - Upgrade to 6.3, upstream security fixes, SA-2008-044. -------------------------------------------------------------------------------- References: [ 1 ] Bug #500707 - drupal-README.fedora should give hints about where to install modules https://bugzilla.redhat.com/show_bug.cgi?id=500707 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update drupal' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-ann... (Log in to post comments)
|
|||||||||||||||||||