Debian Security Advisory

DSA-3291-1 drupal7 -- security update

Date Reported:
18 Jun 2015
Affected Packages:
drupal7
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2015-3231, CVE-2015-3232, CVE-2015-3233, CVE-2015-3234.
More information:

Several vulnerabilities were found in drupal7, a content management platform used to power websites.

  • CVE-2015-3231

    Incorrect cache handling made private content viewed by user 1 exposed to other, non-privileged users.

  • CVE-2015-3232

    A flaw in the Field UI module made it possible for attackers to redirect users to malicious sites.

  • CVE-2015-3233

    Due to insufficient URL validation, the Overlay module could be used to redirect users to malicious sites.

  • CVE-2015-3234

    The OpenID module allowed an attacker to log in as other users, including administrators.

For the oldstable distribution (wheezy), these problems have been fixed in version 7.14-2+deb7u10.

For the stable distribution (jessie), these problems have been fixed in version 7.32-1+deb8u4.

For the unstable distribution (sid), these problems have been fixed in version 7.38.1.

We recommend that you upgrade your drupal7 packages.