Security update

• Advisory ID: DRUPAL-SA-CONTRIB-2010-109
• Projects: Embedded Media Field, Media: Video Flotsam, Media: Audio Flotsam (third-party module)
• Version: 5.x and 6.x
• Date: 2010-December-08
• Security risk: Moderately Critical
• Exploitable from: Remote
• Vulnerability: Multiple vulnerabilities

Description

1 - Arbitrary File Upload/Code Execution Vulnerability

Two areas of potential vulnerability were identified and have been fixed. These had to do with a SQL injection vulnerability in one case and exposing hidden nodes in the other.

This release contains no new features. Those will be forthcoming.

SA-CONTRIB-2010-106: Fixing XSS issue when displaying the edited message.

Changes since DRUPAL-7-0-BETA3:

Security release for SA-CONTRIB-2010-104 - Relevant Content - Information Disclosure

Security release for SA-CONTRIB-2010-104 - Relevant Content - Information Disclosure

Also includes many bug fixes since 1.4.