CVE-2012-5653

Related Files

Debian Security Advisory 2776-1

Posted Oct 11, 2013

Authored by Debian | Site debian.org

Debian Linux Security Advisory 2776-1 - Multiple vulnerabilities have been been fixed in the Drupal content management framework, resulting in information disclosure, insufficient validation, cross-site scripting and cross-site request forgery.

tags | advisory, vulnerability, xss, info disclosure, csrf

systems | linux, debian

advisories | CVE-2012-0825, CVE-2012-0826, CVE-2012-5651, CVE-2012-5652, CVE-2012-5653, CVE-2013-0244, CVE-2013-0245

SHA-256 | 45a72bfd68d855596936144a4be64a54d8096cdaf8020e5dd7667dc60a77524e

Download | Favorite | View

Mandriva Linux Security Advisory 2013-074

Posted Apr 9, 2013

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-074 - Drupal core's text filtering system provides several features including removing inappropriate HTML tags and automatically linking content that appears to be a link. A pattern in Drupal's text matching was found to be inefficient with certain specially crafted strings. This vulnerability is mitigated by the fact that users must have the ability to post content sent to the filter system such as a role with the post comments or Forum topic: Create new content permission. Drupal core's Form API allows users to set a destination, but failed to validate that the URL was internal to the site. Various other issues were also addressed.

tags | advisory

systems | linux, mandriva

advisories | CVE-2012-1588, CVE-2012-1589, CVE-2012-1590, CVE-2012-1591, CVE-2012-2153, CVE-2012-2922, CVE-2012-5651, CVE-2012-5653

SHA-256 | 305565fad63e2c490bf4982c07542b89e5b1bdde6be00766a998df8012622803

Download | Favorite | View