Drupal Security Announcements | Joe Baker

Drupal Security Announcements

This list is for security announcements sent out be the Drupal security team.

URL

http://drupal.org/taxonomy/term/44/0

Last update

4 years 13 weeks ago

March 13, 2006

21:04

Mail header injection vulnerability

Advisory ID: DRUPAL-SA-2006-004
Project: Drupal core
Date: 2006-03-13
Security risk: moderately critical
Impact: security bypass
Where: from remote
Vulnerability: mail header injection attack

21:00

Session fixation vulnerability

Advisory ID: DRUPAL-SA-2006-003
Project: Drupal core
Date: 2006-03-13
Security risk: less critical
Impact: hijacking
Where: from remote
Vulnerability: session fixation attack

20:45

XSS vulnerabilities

Advisory ID: DRUPAL-SA-2006-002
Project: Drupal core
Date: 2006-03-13
Security risk: less critical
Impact: cross-site scripting
Where: from remote
Vulnerability: cross-site scripting

20:21

Security bypass in menu.module

Advisory ID: DRUPAL-SA-2006-001
Project: Drupal core
Date: 2006-03-13
Security risk: less critical
Impact: security bypass
Where: from remote
Vulnerability: bypass access control

January 4, 2006

16:15

False Drupal XSS alarm on BugTraq

Someone under the pseudonym "Liz0ziM" sent a false security alarm to BugTraq without first contacting the security team: http://www.securityfocus.com/archive/1/420671/30/0/threaded This vulnerability is fixed in Drupal 4.5.6, 4.6.4 and onwards. Drupal's new XSS filter mechanism takes care of all vulnerabilities listed on http://ha.ckers.org/xss.html (and even more). If you have already updated to at least 4.5.6 / 4.6.4 then you are safe and you do not need to take any action. If you have not updated yet, then we advise you again to do so ASAP.