Security bugs are reported here via bugzilla

[Eric Sandall <eric AT sandall.us>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Synopsis
========
drupal branch 4.6 earlier than 4.6.2 and 4.55 branch earlier than 4.5.4
suffer security vulnerabilities in input filters (DRUPAL-SA-2005-002)
and the XML-RPC library (DRUPAL-SA-2005-003).

Background
==========
Drupal - Open source content management platform

Description
===========
DRUPAL-SA-2005-002:
Kuba Zygmunt discovered a flaw in the input validation routines of
Drupal's
filter mechanism.  An attacker could execute arbitrary PHP code on a
target
site when public comments or postings are allowed.

DRUPAL-SA-2005-003:
A flaw has been discovered in the third-party XML-RPC library included
with
Drupal.  An attacker could execute arbitrary PHP code on a target site.

Impact
======
A remote machine could execute arbitrary PHP code on a machine running a
vulnerable instance of Drupal (through XML-RPC in general as well as
public comments or postings).

Affected packages
=================
drupal in all grimoires devel and test is affected.
This is now fixed in all affected grimoires.

Resolution
==========
All drupal users should upgrade to the latest available version:
        # scribe update
        # cast -c drupal

References
==========
  [ 1 ] DRUPAL-SA-2005-002
        http://drupal.org/files/sa-2005-002/advisory.txt
  [ 2 ] DRUPAL-SA-2005-003
        http://drupal.org/files/sa-2005-003/advisory.txt
  [ 3 ] Drupal 4.6.2/4.5.4 release
        http://drupal.org/drupal-4.6.2

- -sandalle

- --
Eric Sandall                        |  Source Mage GNU/Linux Developer
eric at sandall.us PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
http://eric.sandall.us/             |  SysAdmin @ Inst. Shock Physics @
WSU
http://counter.li.org/  #196285     |  http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCwzjIHXt9dKjv3WERArGeAKCqQR2gL3NLfi37dnueDehlMV+46gCbBbFU
ZsE3I239pizZl4ntKcT91wI=
=q1EE
-----END PGP SIGNATURE-----

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.