Skip to Content.
Sympa Menu

sm-admin - [SM-Admin] Fwd: [Bug 13634] New: security update for drupal to 4.7.6

sm-admin AT lists.ibiblio.org

Subject: Developer Only Discussion List

List archive

Chronological Thread  
  • From: Jeremy Blosser <jblosser-smgl AT firinn.org>
  • To: sm-admin AT lists.ibiblio.org
  • Subject: [SM-Admin] Fwd: [Bug 13634] New: security update for drupal to 4.7.6
  • Date: Mon, 19 Mar 2007 16:02:43 -0500

I need someone to step up and own keeping Drupal updating on
www.sourcemage.org, or it's going to have to come down. As the guy who
owns the server I cannot allow software to be installed that isn't
maintained against this kind of vulnerability. I also don't have time or
inclination to do all the updates myself when I've got other stuff I need
to do and the actual value this app provides us right now is so limited.

Those of you want that want to keep Drupal vs. just a wiki, the option is
up to you, right now. Either one of your volunteers to keep it updated, or
not.

----- Forwarded message from bugzilla-daemon AT bugs.sourcemage.org -----

Date: 19 Mar 2007 19:45:55 -0000
From: bugzilla-daemon AT bugs.sourcemage.org
To: collab AT sourcemage.org
Subject: [Bug 13634] New: security update for drupal to 4.7.6

http://bugs.sourcemage.org/show_bug.cgi?id=13634

Summary: security update for drupal to 4.7.6
Product: Codex
Version: stable grimoire
Platform: All
URL: http://drupal.org/files/sa-2007-005/advisory.txt
OS/Version: Linux
Status: NEW
Severity: blocker
Priority: P1
Component: collab
AssignedTo: collab AT sourcemage.org
ReportedBy: eric AT sandall.us


From the security advisory in URL:
----------------------------------------------------------------------------
Drupal security advisory DRUPAL-SA-2007-005
----------------------------------------------------------------------------
Project: Drupal core
Version: 4.7.x, 5.x
Date: 2007-Jan-29
Security risk: Highy critical
Exploitable from: Remote
Vulnerability: Arbitrary code execution
----------------------------------------------------------------------------

Description
-----------
Previews on comments were not passed through normal form validation routines,
enabling users with the 'post comments' permission and access to more than one
input filter to execute arbitrary code. By default, anonymous and
authenticated
users have access to only one input format.

Immediate workarounds include: disabling the comment module, revoking the
'post
comments' permission for all users or limiting access to one input format.

Versions affected
-----------------
- Drupal 4.7.x versions before Drupal 4.7.6
- Drupal 5.x versions before Drupal 5.1

We have 4.7.3 in all grimoires.

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

----- End forwarded message -----

Attachment: pgp6P4O3bKZ6r.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page