See: http://drupal.org/node/1168756

"A reflected cross site scripting vulnerability was discovered in Drupal's error handler. Drupal displays PHP errors in the messages area, and a specially crafted URL can cause malicious scripts to be injected into the message. The issue can be mitigated by disabling on-screen error display at admin/settings/error-reporting. This is the recommended setting for production sites.

This issue affects Drupal 6.x only."

Comments

johnbarclay’s picture

johnbarclay commented
Status: Active » Needs review

Drupal 6 patches:

-    $entry = $types[$errno] .': '. $message .' in '. $filename .' on line '. $line .'.';
+    $entry = check_plain($types[$errno]) .': '. filter_xss($message) .' in '. check_plain($filename) .' on line '. check_plain($line) .'.';

http://drupalcode.org/project/drupal.git/blobdiff/8636b1234c84a07f0f087c...

This seems to map directly for 6 to 5?