[SECURITY] Fedora 11 Update: drupal-date-6.x.2.3-0.fc11

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2009-8184
2009-07-31 17:31:36
--------------------------------------------------------------------------------

Name        : drupal-date
Product     : Fedora 11
Version     : 6.x.2.3
Release     : 0.fc11
URL         : http://drupal.org/project/date
Summary     : This package contains both the Date module and a Date API module
Description :
The Date API is available to be used by other modules and is not dependent
on having CCK installed.  The date module is a flexible date/time field
type for the cck content module which requires the CCK content.module and
the Date API module.

--------------------------------------------------------------------------------
Update Information:

* Advisory ID: DRUPAL-SA-CONTRIB-2009-046   * Project: Date (third-party
module)   * Version: 6.x   * Date: 2009-July-29   * Security risk: Moderately
critical   * Exploitable from: Remote   * Vulnerability: Cross Site Scripting
-------- DESCRIPTION ---------------------------------------------------------
The Date module provides a date CCK field that can be added to any content
type. The Date Tools module that is bundled with Date module does not  properly
escape user input when displaying labels for fields on a content  type. A
malicious user with the 'use date tools' permission of the Date Tools  sub-
module, or the 'administer content types' permission could attempt a  cross site
scripting [1] (XSS) attack when creating a new content type,  leading to the
user gaining full administrative access.  -------- VERSIONS AFFECTED
---------------------------------------------------     * Date for Drupal 6.x
prior to 6.x-2.3    Drupal core is not affected. If you do not use the
contributed Date module,  there is nothing you need to do.  -------- SOLUTION
------------------------------------------------------------    Upgrade to the
latest version:   * If you use Date for Drupal 6.x upgrade to Date 6.x-2.3 [2]
Note that the 'use date tools' permission has been renamed as 'administer  date
tools' to clarify that this is an administrative permission (it allows  the
creation of new content types via a wizard form). You will need to  re-assign
this permission to any roles that were using it. See also the Date  project page
[3].  -------- REPORTED BY
---------------------------------------------------------    Stella Power [4] of
the Drupal Security Team  -------- FIXED BY
------------------------------------------------------------    Stella Power [5]
and Karen Stevenson [6], the project maintainer.  -------- CONTACT
-------------------------------------------------------------    The security
contact for Drupal can be reached at security at drupal.org or  via the form at
http://drupal.org/contact.    [1] http://en.wikipedia.org/wiki/Cross-
site_scripting  [2] http://drupal.org/node/534332  [3]
http://drupal.org/project/date  [4] http://drupal.org/user/66894  [5]
http://drupal.org/user/66894  [6] http://drupal.org/user/45874
--------------------------------------------------------------------------------
ChangeLog:

* Wed Jul 29 2009 Jon Ciesla  - 6.x.2.3-0
- Update to new version.
- Fix for DRUPAL-SA-CONTRIB-2009-046.
* Fri Jul 24 2009 Fedora Release Engineering  - 6.x.2.0-2.rc4.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update drupal-date' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------