BugTraq
[ MDVSA-2014:031 ] drupal Feb 14 2014 03:37PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:031
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : drupal
Date : February 14, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Multiple security issues was identified and fixed in drupal:

The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows
remote OpenID users to authenticate as other users via unspecified
vectors (CVE-2014-1475).

The Taxonomy module in Drupal 7.x before 7.26, when upgraded from
an earlier version of Drupal, does not properly restrict access to
unpublished content, which allows remote authenticated users to obtain
sensitive information via a listing page (CVE-2014-1476).

The updated packages has been upgraded to the 7.26 version which is
unaffected by these security flaws.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1475
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1476
https://drupal.org/SA-CORE-2014-001
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
1561765f33c6a67a7b63ecbc783a8e68 mbs1/x86_64/drupal-7.26-1.mbs1.noarch.rpm
5d8bb1fedd2fc2acfe50272dbc57dc50 mbs1/x86_64/drupal-mysql-7.26-1.mbs1.noarch.rpm
6f4d6b410161ef37d36e055b75ac61bf mbs1/x86_64/drupal-postgresql-7.26-1.mbs1.noarch.rpm
614f9cb70cbb955f445bbb3fc77dc819 mbs1/x86_64/drupal-sqlite-7.26-1.mbs1.noarch.rpm
34636e9e6743b2b8e1e3e4c46156eb6c mbs1/SRPMS/drupal-7.26-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFS/g4OmqjQ0CJFipgRAnyuAKCuYKaLOPAPFDMASVzfPls126i77gCgqb64
GSilzcyyvrDTv2pvUEk/ooY=
=IgHR
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus