[SECURITY] Fedora 10 Update: drupal-6.13-1.fc10

updates at fedoraproject.org updates at fedoraproject.org
Fri Jul 3 19:54:24 UTC 2009

Fedora Update Notification
2009-07-03 18:39:15

Name        : drupal
Product     : Fedora 10
Version     : 6.13
Release     : 1.fc10
URL         : http://www.drupal.org
Summary     : An open-source content-management platform
Description :
Equipped with a powerful blend of features, Drupal is a Content Management
System written in PHP that can support a variety of websites ranging from
personal weblogs to large community-driven websites.  Drupal is highly
configurable, skinnable, and secure.

Update Information:

Fixes SA-CORE-2009-007 ( http://drupal.org/node/507572 ).    Remember to log in
to your site as the admin user before upgrading this package. After upgrading
the package, browse to http://host/drupal/update.php to run the upgrade script.
Multiple vulnerabilities and weaknesses were discovered in Drupal.    Cross-site
scripting    The Forum module does not correctly handle certain arguments
obtained from the URL. By enticing a suitably privileged user to visit a
specially crafted URL, a malicious user is able to insert arbitrary HTML and
script code into forum pages. Such a cross-site scripting attack may lead to the
malicious user gaining administrative access. Wikipedia has more information
about cross-site scripting (XSS).    This issue affects Drupal 6.x only.
Input format access bypass    User signatures have no separate input format,
they use the format of the comment with which they are displayed. A user will no
longer be able to edit a comment when an administrator changes the comment's
input format to a format that is not accessible to the user. However they will
still be able to modify their signature, which will then be processed by the new
input format.    If the new format is very permissive, via their signature, the
user may be able to insert arbitrary HTML and script code into pages or, when
the PHP filter is enabled for the new format, execute PHP code.    This issue
affects Drupal 6.x only.      Password leaked in URL    When an anonymous user
fails to login due to mistyping his username or password, and the page he is on
contains a sortable table, the (incorrect) username and password are included in
links on the table. If the user visits these links the password may then be
leaked to external sites via the HTTP referer.    In addition, if the anonymous
user is enticed to visit the site via a specially crafted URL while the Drupal
page cache is enabled, a malicious user might be able to retrieve the
(incorrect) username and password from the page cache.    This issue affects
both Drupal 5.x and Drupal 6.x

* Thu Jul  2 2009 Jon Ciesla <limb at jcomserv.net> - 6.13-1
- Update to 6.11, SA-CORE-2009-007.
- Added clarifying text on module installation to readme, BZ 500707.
* Thu May 14 2009 Jon Ciesla <limb at jcomserv.net> - 6.12-1
- Update to 6.11, SA-CORE-2009-006.
* Thu Apr 30 2009 Jon Ciesla <limb at jcomserv.net> - 6.11-1
- Update to 6.11, SA-CORE-2009-005.
* Mon Apr 27 2009 Jon Ciesla <limb at jcomserv.net> - 6.10-2
- Added SELinux/sendmail note to README, BZ 497642.
* Thu Feb 26 2009 Jon Ciesla <limb at jcomserv.net> - 6.10-1
- Update to 6.10, SA-CORE-2009-003.
* Tue Feb 17 2009 Jon Ciesla <limb at jcomserv.net> - 6.9-2
- Drop pre script for files move, 472642.
- Updated drupal-README.fedora.
- Mark cron job noreplace, BZ 485567.
* Thu Jan 15 2009 Jon Ciesla <limb at jcomserv.net> - 6.9-1
- Upgrade to 6.9, SA-CORE-2009-001.
* Fri Jan  2 2009 Jon Ciesla <limb at jcomserv.net> - 6.8-1
- Upgrade to 6.8.
- Move files directories from sites to /var/lib/drupal/files/N for selinux reasons, 472642.
- Included script to move files outside of default, use at your own risk, patches welcome.
* Thu Dec 11 2008 Jon Ciesla <limb at jcomserv.net> - 6.7-1
- Upgrade to 6.7, SA-2008-073.

  [ 1 ] Bug #500707 - drupal-README.fedora should give hints about where to install modules

This update can be installed with the "yum" update program.  Use 
su -c 'yum update drupal' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at

More information about the Fedora-package-announce mailing list