October 2018 - Security-news - lists.drupal.org

Search API Solr Search - Moderately critical - Access bypass - SA-CONTRIB-2018-065
by security-news＠drupal.org 10 Oct '18

10 Oct '18

View online: https://www.drupal.org/sa-contrib-2018-065 Project: Search API Solr Search [1] Version: 7.x-1.13 Date: 2018-October-10 Security risk: *Moderately critical* 10∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. The module doesn't sufficiently take the searched fulltext fields into account when creating a search excerpt. This can, in specific cases, lead to confidential data being leaked as part of the search excerpt. Solution: Install the latest version: * If you use the Search API Solr Search module for Drupal 7.x, upgrade to Search API Solr Search 7.x-1.14 [3] Also see the Search API Solr Search [4] project page. Reported By: * Ronino [5] Fixed By: * Thomas Seidl [6] * Markus Kalkbrenner [7] * Ronino [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/search_api_solr [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/search_api_solr/releases/7.x-1.14 [4] https://www.drupal.org/project/search_api_solr [5] https://www.drupal.org/user/645948 [6] https://www.drupal.org/user/205582 [7] https://www.drupal.org/user/124705 [8] https://www.drupal.org/user/645948 [9] https://www.drupal.org/u/mlhess [10] https://www.drupal.org/u/greggles

1 0

Lightbox2 - Critical - Cross Site Scripting - SA-CONTRIB-2018-064
by security-news＠drupal.org 10 Oct '18

10 Oct '18

View online: https://www.drupal.org/sa-contrib-2018-064 Project: Lightbox2 [1] Version: 7.x-2.x-dev Date: 2018-October-10 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: The Lightbox2 module enables you to overlay images on the current page. The module did not sanitize some inputs when used in combination with a custom view leading to potential Cross Site Scripting (XSS). Solution: Install the latest version: * If you use the Lightbox2 module for Drupal 7.x, upgrade to Lightbox2 release 7.x-2.11 [3] Also see the Lightbox2 [4] project page. Reported By: * emf [5] Fixed By: * joseph.olstad [6] * Stella Power [7] of the Drupal Security Team Coordinated By: * David Stoline [8] of the Drupal Security Team [1] https://www.drupal.org/project/lightbox2 [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/lightbox2/releases/7.x-2.11 [4] https://www.drupal.org/project/lightbox2 [5] https://www.drupal.org/user/664258 [6] https://www.drupal.org/user/1321830 [7] https://www.drupal.org/user/66894 [8] https://www.drupal.org/user/329570

1 0

Printer, email and PDF versions - Highly critical - Remote Code Execution - SA-CONTRIB-2018-063
by security-news＠drupal.org 03 Oct '18

03 Oct '18

View online: https://www.drupal.org/sa-contrib-2018-063 Project: Printer, email and PDF versions [1] Version: 7.x-2.x-dev Date: 2018-October-03 Security risk: *Highly critical* 20∕25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Remote Code Execution Description: This module provides printer-friendly versions of content, including send by e-mail and PDF versions. The module doesn't sufficiently sanitize the arguments passed to the wkhtmltopdf executable, allowing a remote attacker to execute arbitrary shell commands. It also doesn't sufficiently sanitize the HTML content passed to dompdf, allowing a privileged attacker to execute arbitrary PHP code. This vulnerability is mitigated by the fact that the site must have either the wkhtmltopdf or dompdf sub-modules enabled and selected as the PDF generation tool. In the case of the dompdf vulnerability, the attacker must be able to write content to the site. Solution: Install the latest version: * If you use the print module for Drupal 7.x, upgrade to print 7.x-2.1 [3] In alternative, disable PDF generation, or replace the PDF generation library with another of the supported versions. Also see the Printer, email and PDF versions [4] project page. Reported By: * yoloClin [5] Fixed By: * Lee Rowlands [6] of the Drupal Security Team * João Ventura [7] * yoloClin [8] Coordinated By: * Lee Rowlands [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team [1] https://www.drupal.org/project/print [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/print/releases/7.x-2.1 [4] https://www.drupal.org/project/print [5] https://www.drupal.org/user/3585171 [6] https://www.drupal.org/user/395439 [7] https://www.drupal.org/user/122464 [8] https://www.drupal.org/user/3585171 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/u/mlhess

1 0