Debian Security Advisory
DSA-1792-1 drupal6 -- multiple vulnerabilities
- Date Reported:
- 06 May 2009
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 526378.
In Mitre's CVE dictionary: CVE-2009-1575, CVE-2009-1576.
- More information:
Multiple vulnerabilities have been discovered in drupal, a web content management system. The Common Vulnerabilities and Exposures project identifies the following problems:
Moritz Naumann discovered an information disclosure vulnerability. If a user is tricked into visiting the site via a specially crafted URL and then submits a form (such as the search box) from that page, the information in their form submission may be directed to a third-party site determined by the URL and thus disclosed to the third party. The third party site may then execute a cross-site request forgery attack against the submitted form.
The old stable distribution (etch) does not contain drupal and is not affected.
For the stable distribution (lenny), these problems have been fixed in version 6.6-3lenny1.
For the unstable distribution (sid), these problems have been fixed in version 6.11-1
We recommend that you upgrade your drupal6 package.
- Fixed in:
Debian GNU/Linux 5.0 (lenny)
- Architecture-independent component:
MD5 checksums of the listed files are available in the original advisory.