-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-7315 2009-07-03 18:38:14 --------------------------------------------------------------------------------
Name : drupal Product : Fedora 11 Version : 6.13 Release : 1.fc11 URL : http://www.drupal.org Summary : An open-source content-management platform Description : Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure.
-------------------------------------------------------------------------------- Update Information:
Fixes SA-CORE-2009-007 ( http://drupal.org/node/507572 ). Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script. Multiple vulnerabilities and weaknesses were discovered in Drupal. Cross-site scripting The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS). This issue affects Drupal 6.x only. Input format access bypass User signatures have no separate input format, they use the format of the comment with which they are displayed. A user will no longer be able to edit a comment when an administrator changes the comment's input format to a format that is not accessible to the user. However they will still be able to modify their signature, which will then be processed by the new input format. If the new format is very permissive, via their signature, the user may be able to insert arbitrary HTML and script code into pages or, when the PHP filter is enabled for the new format, execute PHP code. This issue affects Drupal 6.x only. Password leaked in URL When an anonymous user fails to login due to mistyping his username or password, and the page he is on contains a sortable table, the (incorrect) username and password are included in links on the table. If the user visits these links the password may then be leaked to external sites via the HTTP referer. In addition, if the anonymous user is enticed to visit the site via a specially crafted URL while the Drupal page cache is enabled, a malicious user might be able to retrieve the (incorrect) username and password from the page cache. This issue affects both Drupal 5.x and Drupal 6.x -------------------------------------------------------------------------------- ChangeLog:
* Thu Jul 2 2009 Jon Ciesla limb@jcomserv.net - 6.13-1 - Update to 6.11, SA-CORE-2009-007. - Added clarifying text on module installation to readme, BZ 500707. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #500707 - drupal-README.fedora should give hints about where to install modules https://bugzilla.redhat.com/show_bug.cgi?id=500707 --------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use su -c 'yum update drupal' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys --------------------------------------------------------------------------------
package-announce@lists.fedoraproject.org