Show advisories for only Drupal core, only contributed projects, or all security advisories

Security-related announcements, such as information on best practices.

PHP exploit using Drupal circulating - PSA-2007-001

Date: 
2007-October-17
  • Project: PHP
  • Version: PHP 4 < 4.4.3, PHP 5 < 5.1.4
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: unset() hash / index collision exploit using Drupal (CVE-2006-3017)

Description

False Drupal XSS alarm on BugTraq - PSA-2006-001

Date: 
2006-January-04

Someone under the pseudonym "Liz0ziM" sent a false security alarm to BugTraq without first contacting the security team:

http://www.securityfocus.com/archive/1/420671/30/0/threaded

This vulnerability is fixed in Drupal 4.5.6, 4.6.4 and onwards. Drupal's new XSS filter mechanism takes care of all vulnerabilities listed on http://ha.ckers.org/xss.html (and even more).

Pages

Subscribe with RSS Subscribe to Security public service announcements