--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2009-7315
2009-07-03 18:38:14
--------------------------------------------------------------------------------

Name        : drupal
Product     : Fedora 11
Version     : 6.13
Release     : 1.fc11
URL         : http://www.drupal.org
Summary     : An open-source content-management platform
Description :
Equipped with a powerful blend of features, Drupal is a Content Management
System written in PHP that can support a variety of websites ranging from
personal weblogs to large community-driven websites.  Drupal is highly
configurable, skinnable, and secure.

--------------------------------------------------------------------------------
Update Information:

Fixes SA-CORE-2009-007 ( http://drupal.org/node/507572 ).    Remember to log in
to your site as the admin user before upgrading this package. After upgrading
the package, browse to http://host/drupal/update.php to run the upgrade script.
Multiple vulnerabilities and weaknesses were discovered in Drupal.    Cross-site
scripting    The Forum module does not correctly handle certain arguments
obtained from the URL. By enticing a suitably privileged user to visit a
specially crafted URL, a malicious user is able to insert arbitrary HTML and
script code into forum pages. Such a cross-site scripting attack may lead to the
malicious user gaining administrative access. Wikipedia has more information
about cross-site scripting (XSS).    This issue affects Drupal 6.x only.
Input format access bypass    User signatures have no separate input format,
they use the format of the comment with which they are displayed. A user will no
longer be able to edit a comment when an administrator changes the comment's
input format to a format that is not accessible to the user. However they will
still be able to modify their signature, which will then be processed by the new
input format.    If the new format is very permissive, via their signature, the
user may be able to insert arbitrary HTML and script code into pages or, when
the PHP filter is enabled for the new format, execute PHP code.    This issue
affects Drupal 6.x only.      Password leaked in URL    When an anonymous user
fails to login due to mistyping his username or password, and the page he is on
contains a sortable table, the (incorrect) username and password are included in
links on the table. If the user visits these links the password may then be
leaked to external sites via the HTTP referer.    In addition, if the anonymous
user is enticed to visit the site via a specially crafted URL while the Drupal
page cache is enabled, a malicious user might be able to retrieve the
(incorrect) username and password from the page cache.    This issue affects
both Drupal 5.x and Drupal 6.x
--------------------------------------------------------------------------------
ChangeLog:

* Thu Jul  2 2009 Jon Ciesla  - 6.13-1
- Update to 6.11, SA-CORE-2009-007.
- Added clarifying text on module installation to readme, BZ 500707.
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #500707 - drupal-README.fedora should give hints about where to install modules
        https://bugzilla.redhat.com/show_bug.cgi?id=500707
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update drupal' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------

_______________________________________________
Fedora-package-announce mailing list
Fedora-package-announce@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-package-announce