Debian Bug report logs - #526378
drupal6: Security vulnerabilitie SA-CORE-2009-005

version graph

Package: drupal6; Maintainer for drupal6 is Luigi Gangitano <luigi@debian.org>;

Reported by: Christoph Fischer <debian@christophfischer.com>

Date: Thu, 30 Apr 2009 19:39:02 UTC

Severity: normal

Found in version drupal6/6.6-3

Fixed in versions drupal6/6.11-1, drupal6/6.6-3lenny1

Done: Luigi Gangitano <luigi@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Luigi Gangitano <luigi@debian.org>:
Bug#526378; Package drupal6. (Thu, 30 Apr 2009 19:39:05 GMT) Full text and rfc822 format available.

Acknowledgement sent to Christoph Fischer <debian@christophfischer.com>:
New Bug report received and forwarded. Copy sent to Luigi Gangitano <luigi@debian.org>. (Thu, 30 Apr 2009 19:39:05 GMT) Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Christoph Fischer <debian@christophfischer.com>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: drupal6: Security vulnerabilitie SA-CORE-2009-005
Date: Thu, 30 Apr 2009 19:32:38 +0000
Package: drupal6
Version: 6.6-3
Severity: normal

Drupal 6 has a cross site scripting bug (XSS). See http://drupal.org/node/449078 for more information. A patch is also available.

-- System Information:
Debian Release: 5.0.1
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.9-023stab046.2-enterprise (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to de_DE.utf8)
Shell: /bin/sh linked to /bin/bash

Versions of packages drupal6 depends on:
ii  apache2-mpm-worker 2.2.9-10+lenny2       Apache HTTP Server - high speed th
ii  curl               7.18.2-8lenny2        Get a file from an HTTP, HTTPS or 
ii  dbconfig-common    1.8.39                common framework for packaging dat
ii  debconf [debconf-2 1.5.24                Debian configuration management sy
ii  libjs-jquery       1.2.6-2               JavaScript library for dynamic web
ii  mysql-client       5.0.51a-24+lenny1     MySQL database client (metapackage
ii  mysql-client-5.0 [ 5.0.51a-24+lenny1     MySQL database client binaries
ii  php5               5.2.6.dfsg.1-1+lenny2 server-side, HTML-embedded scripti
ii  php5-gd            5.2.6.dfsg.1-1+lenny2 GD module for php5
ii  php5-mysql         5.2.6.dfsg.1-1+lenny2 MySQL module for php5
ii  postfix [mail-tran 2.5.5-1.1             High-performance mail transport ag
ii  wwwconfig-common   0.1.2                 Debian web auto configuration

Versions of packages drupal6 recommends:
ii  mysql-server           5.0.51a-24+lenny1 MySQL database server (metapackage
ii  mysql-server-5.0 [mysq 5.0.51a-24+lenny1 MySQL database server binaries

drupal6 suggests no packages.

-- debconf information excluded




Reply sent to Luigi Gangitano <luigi@debian.org>:
You have taken responsibility. (Mon, 04 May 2009 19:03:07 GMT) Full text and rfc822 format available.

Notification sent to Christoph Fischer <debian@christophfischer.com>:
Bug acknowledged by developer. (Mon, 04 May 2009 19:03:07 GMT) Full text and rfc822 format available.

Message #10 received at 526378-close@bugs.debian.org (full text, mbox):

From: Luigi Gangitano <luigi@debian.org>
To: 526378-close@bugs.debian.org
Subject: Bug#526378: fixed in drupal6 6.11-1
Date: Mon, 04 May 2009 18:47:03 +0000
Source: drupal6
Source-Version: 6.11-1

We believe that the bug you reported is fixed in the latest version of
drupal6, which is due to be installed in the Debian FTP archive:

drupal6_6.11-1.diff.gz
  to pool/main/d/drupal6/drupal6_6.11-1.diff.gz
drupal6_6.11-1.dsc
  to pool/main/d/drupal6/drupal6_6.11-1.dsc
drupal6_6.11-1_all.deb
  to pool/main/d/drupal6/drupal6_6.11-1_all.deb
drupal6_6.11.orig.tar.gz
  to pool/main/d/drupal6/drupal6_6.11.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 526378@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Luigi Gangitano <luigi@debian.org> (supplier of updated drupal6 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Mon, 04 May 2009 19:56:12 +0200
Source: drupal6
Binary: drupal6
Architecture: source all
Version: 6.11-1
Distribution: unstable
Urgency: low
Maintainer: Luigi Gangitano <luigi@debian.org>
Changed-By: Luigi Gangitano <luigi@debian.org>
Description: 
 drupal6    - a fully-featured content management framework
Closes: 526378
Changes: 
 drupal6 (6.11-1) unstable; urgency=low
 .
   [ Luigi Gangitano ]
   * New upstream release
     - Fixes XSS vulnerability (Ref: SA-CORE-2009-005, CVE-TBD)
       (Closes: #526378)
Checksums-Sha1: 
 7b761e4bf316a51b392c2123c9e55cca3a8222d9 1112 drupal6_6.11-1.dsc
 083fdf4f7248603677b3c294f7ddb060a07d4fa8 1078966 drupal6_6.11.orig.tar.gz
 6053ade00f0cb695f86d4c1c017fa5719483d25e 16199 drupal6_6.11-1.diff.gz
 474d379d4cc6415b16f9f5ee032c17d7e217add2 1092782 drupal6_6.11-1_all.deb
Checksums-Sha256: 
 b928106c161d8594137aac7eb528933e33b18a75806a69476f66ac71ecbd59e4 1112 drupal6_6.11-1.dsc
 89d360d667a527235ceb10962cfffd0448194636b7d2b73cf22ff8b13a7d2f1b 1078966 drupal6_6.11.orig.tar.gz
 255836512ade38ca6c55b566abc9f57524f59b2725471f03a92e3a7cd8c6775a 16199 drupal6_6.11-1.diff.gz
 9b3b64cefaa8979ec9cec8177e55ab7b9fdc2830e712b442d7bc3c04834de00c 1092782 drupal6_6.11-1_all.deb
Files: 
 80f4ada42eff0b7cdd68ef4b78f10127 1112 web extra drupal6_6.11-1.dsc
 6a341807b83c4e48f50ce7921562402c 1078966 web extra drupal6_6.11.orig.tar.gz
 b8d0ab3e390322cd44b956560bde1581 16199 web extra drupal6_6.11-1.diff.gz
 40bcb8e1e3b5590b7d95cfa296aff6fb 1092782 web extra drupal6_6.11-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)

iEYEARECAAYFAkn/NOgACgkQ8ZumGJJMDCbVrACfVj7wAyE0LKCHS1wnGeopn6YZ
H+8AmwR1ccrV8xly+AyLy1y+mXd+KK3S
=8rEY
-----END PGP SIGNATURE-----





Reply sent to Luigi Gangitano <luigi@debian.org>:
You have taken responsibility. (Thu, 11 Jun 2009 08:15:09 GMT) Full text and rfc822 format available.

Notification sent to Christoph Fischer <debian@christophfischer.com>:
Bug acknowledged by developer. (Thu, 11 Jun 2009 08:15:09 GMT) Full text and rfc822 format available.

Message #15 received at 526378-close@bugs.debian.org (full text, mbox):

From: Luigi Gangitano <luigi@debian.org>
To: 526378-close@bugs.debian.org
Subject: Bug#526378: fixed in drupal6 6.6-3lenny1
Date: Thu, 11 Jun 2009 07:54:35 +0000
Source: drupal6
Source-Version: 6.6-3lenny1

We believe that the bug you reported is fixed in the latest version of
drupal6, which is due to be installed in the Debian FTP archive:

drupal6_6.6-3lenny1.diff.gz
  to pool/main/d/drupal6/drupal6_6.6-3lenny1.diff.gz
drupal6_6.6-3lenny1.dsc
  to pool/main/d/drupal6/drupal6_6.6-3lenny1.dsc
drupal6_6.6-3lenny1_all.deb
  to pool/main/d/drupal6/drupal6_6.6-3lenny1_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 526378@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Luigi Gangitano <luigi@debian.org> (supplier of updated drupal6 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Mon, 04 May 2009 20:04:05 +0200
Source: drupal6
Binary: drupal6
Architecture: source all
Version: 6.6-3lenny1
Distribution: stable-security
Urgency: high
Maintainer: noahm@debian.org
Changed-By: Luigi Gangitano <luigi@debian.org>
Description: 
 drupal6    - a fully-featured content management framework
Closes: 526378
Changes: 
 drupal6 (6.6-3lenny1) stable-security; urgency=high
 .
   [ Luigi Gangitano ]
   * Urgency high due to security fixes
 .
   * debian/patches/14_SA-CORE-2009-005
     - Added upstream patch fixing an XSS vulnerability
       (Ref: SA-CORE-2009-005, CVE-TBD)
       (Closes: #526378)
Checksums-Sha1: 
 b88cbf98d1ebb3d6779dea43bf9ddba43f6b1e49 1124 drupal6_6.6-3lenny1.dsc
 08c12b590508d2050e3c2be0faf48b98a964ea45 1071507 drupal6_6.6.orig.tar.gz
 a218020c97fe117b32c683479f732d8e32a60bbb 19809 drupal6_6.6-3lenny1.diff.gz
 de863e3120c55adf69f3647f42dde7801bbdf497 1083398 drupal6_6.6-3lenny1_all.deb
Checksums-Sha256: 
 4c401f406d75598fb12b71ae68075b89f5b4568d667b54a967ad960215d81ed6 1124 drupal6_6.6-3lenny1.dsc
 48a5d3c6567b10f401fc7ca8b7dfb0fee22745d77f28992964bc9be80aaa7965 1071507 drupal6_6.6.orig.tar.gz
 bea7458e692d50e41f871f5f3ca7e6b2e4adc7dc0a37b0c9b99c7d82e6b98970 19809 drupal6_6.6-3lenny1.diff.gz
 ba32efaaebff2edbc9f5fd0d35945e25806cc3e23ccff8dab899bc487db45e0b 1083398 drupal6_6.6-3lenny1_all.deb
Files: 
 bedc53674c2746aa0172ba085ee49cf7 1124 web extra drupal6_6.6-3lenny1.dsc
 caaa55d1990b34dee48f5047ce98e2bb 1071507 web extra drupal6_6.6.orig.tar.gz
 907241818d13cff27fd8eb8487002ad6 19809 web extra drupal6_6.6-3lenny1.diff.gz
 0f30de9089c576ecdb85acf8e71e87a3 1083398 web extra drupal6_6.6-3lenny1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKAasKYrVLjBFATsMRAtDhAKCIWkaOHHglwJaCGzl1Up6AocSPKQCfaP6V
RnY47VfiM5qhdSrEFyEg95U=
=0m9J
-----END PGP SIGNATURE-----





Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Fri, 10 Jul 2009 07:33:45 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Apr 20 06:25:17 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.