Advisories » MGASA-2015-0328

Updated drupal packages fix security vulnerabilities

Publication date: 27 Aug 2015
Modification date: 27 Aug 2015
Type: security
Affected Mageia releases : 4 , 5
CVE: CVE-2015-6658 , CVE-2015-6659 , CVE-2015-6660 , CVE-2015-6661 , CVE-2015-6665

Description

Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal
before 7.39 allows remote attackers to inject arbitrary web script or HTML
via a crafted URL, related to uploading files (CVE-2015-6658).

SQL injection vulnerability in the SQL comment filtering system in the
Database API in Drupal before 7.39 allows remote attackers to execute
arbitrary SQL commands via an SQL comment (CVE-2015-6659).

The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly
validate the form token, which allows remote attackers to conduct CSRF
attacks that upload files in a different user's account via vectors related
to "file upload value callbacks" (CVE-2015-6660).

Drupal before 7.39 allows remote attackers to obtain sensitive node titles by
reading the menu (CVE-2015-6661).

Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal before
7.39 allows remote attackers to inject arbitrary web script or HTML via
vectors involving a whitelisted HTML element, possibly related to the "a" tag
(CVE-2015-6665).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=16630
• https://www.drupal.org/SA-CORE-2015-003
• https://www.drupal.org/drupal-7.39
• https://www.drupal.org/drupal-7.39-release-notes
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6658
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6659
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6660
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6661
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6665

SRPMS

4/core

• drupal-7.39-1.mga4

5/core

• drupal-7.39-1.mga5