- Security-news - lists.drupal.org

SA-CONTRIB-2012-153 - Mandrill - Information Disclosure
by security-news＠drupal.org 10 Oct '12

10 Oct '12

View online: http://drupal.org/node/1808846 * Advisory ID: DRUPAL-SA-CONTRIB-2012-153 * Project: Mandrill [1] (third-party module) * Version: 7.x * Date: 2012-October-10 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- This module enables you to send emails using an external gateway and by default logs the contents of the messages. An attacker who gains access to the Mandrill dashboard can trigger password reset emails from the Drupal site, get the reset links from the Mandrill logs, and take over an account. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Mandrill 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Mandrill [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Mandrill module for Drupal 7.x, upgrade to Mandrill 7.x-1.2 [4] Also see the Mandrill [5] project page. -------- REPORTED BY --------------------------------------------------------- * Patrick Dawkins [6] -------- FIXED BY ------------------------------------------------------------ * Lev Tsypin [7] the module maintainer * Ned McClain [8] provisional member of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Ned McClain [9] provisional member of the Drupal Security Team * Ben Jeavons [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/mandrill [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/mandrill [4] http://drupal.org/node/1807894 [5] http://drupal.org/project/mandrill [6] http://drupal.org/user/1025236 [7] http://drupal.org/user/54135 [8] http://drupal.org/user/798324 [9] http://drupal.org/user/798324 [10] http://drupal.org/user/91990 [11] http://drupal.org/user/36762 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-152 - Feeds - Access bypass
by security-news＠drupal.org 10 Oct '12

10 Oct '12

View online: https://drupal.org/node/1808832 * Advisory ID: DRUPAL-SA-CONTRIB-2012-152 * Project: Feeds [1] (third-party module) * Version: 7.x * Date: 2012-October-10 * Security risk: Not critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The feeds module enables you to import or aggregate data as nodes, users, taxonomy terms or simple database records. The module doesn't sufficiently check permissions when creating nodes on behalf of a user. This vulnerability is mitigated by the fact that an attacker must have control over the source feed, and the Feeds importer must have a field from that feed mapped to the node's author. /Note: the Feeds module doesn't have a stable release and therefore a Security Advisory would not normally be issued, per the Drupal Security Team policy [3]. However, this issue affects the Mailhandler [4] module, which does have a stable release. For modules with dependencies, maintainers are encouraged to create stable releases only for those modules dependent on stable releases./ CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Feeds 7.x-2.x versions prior to 7.x-2.0-alpha6. Drupal core is not affected. If you do not use the contributed Feeds [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Feeds module for Drupal 7.x, upgrade to Feeds 7.x-2.0-alpha6 [6]. Also see the Feeds [7] project page. -------- REPORTED BY --------------------------------------------------------- * Iñaki Lopez [8] -------- FIXED BY ------------------------------------------------------------ * Chris Leppanen [9] the module maintainer * Lee Rowlands [10] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/feeds [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/security-advisory-policy [4] http://drupal.org/project/mailhandler [5] http://drupal.org/project/feeds [6] https://drupal.org/node/1808282 [7] http://drupal.org/project/feeds [8] http://drupal.org/user/118449 [9] http://drupal.org/user/473738 [10] http://drupal.org/user/395439 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-151 - Commerce Extra Panes - Cross Site Request Forgery
by security-news＠drupal.org 03 Oct '12

03 Oct '12

View online: http://drupal.org/node/1802258 * Advisory ID: DRUPAL-SA-CONTRIB-2012-151 * Project: Commerce extra panes [1] (third-party module) * Version: 7.x * Date: 2012-October-3 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This module, an add-on for Drupal Commerce, allows site builders to place one or more nodes in one of the checkout phases of an order. The module doesn't sufficiently confirm the intent of a site builder when taking certain administrative operations. This could allow an attacker to trick an administrator into unknowingly enabling/disabled a Commerce extra panes pane. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Commerce extra panes 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Commerce extra panes [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Commerce extra panes module for Drupal 7.x, upgrade to Commerce extra panes 7.x-1.1 [4] Also see the Commerce extra panes [5] project page. -------- REPORTED BY --------------------------------------------------------- * Ivo Van Geertruyen [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Ivo Van Geertruyen [7] of the Drupal Security Team * Pedro Cambra [8] the Module Maintainer -------- COORDINATED BY ------------------------------------------------------ * Ivo Van Geertruyen [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/commerce_extra_panes [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/commerce_extra_panes [4] http://drupal.org/node/1802192 [5] http://drupal.org/project/commerce_extra_panes [6] http://drupal.org/user/383424 [7] http://drupal.org/user/383424 [8] http://drupal.org/user/122101 [9] http://drupal.org/user/383424 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-150 - Twitter Pull - Cross Site Scripting (XSS)
by security-news＠drupal.org 03 Oct '12

03 Oct '12

View online: http://drupal.org/node/1802230 * Advisory ID: DRUPAL-SA-CONTRIB-2012-150 * Project: Twitter Pull [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-October-03 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Twitter Pull allows you to retrieve tweets from Twitter based on a user or search and display them on your site. It also includes integration with the boxes module to allow for simple placement of twitter feeds on various pages. The module doesn't sufficiently filter the data coming from Twitter which could result in script injection and XSS attacks. This vulnerability is mitigated by the fact that Twitter is a generally trusted source and is unlikely to serve malicious content. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Twitter Pull 6.x-1.x versions prior to 6.x-1.3. * Twitter Pull 7.x-1.x versions prior to 7.x-1.0-rc3. Drupal core is not affected. If you do not use the contributed Twitter Pull [3] module, there is nothing you need to do. Drupal core is not affected. If you do not use the contributed Twitter Pull [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Twitter Pull module for Drupal 6.x, upgrade to Twitter Pull 6.x-1.3 [5] * If you use the Twitter Pull module for Drupal 7.x, upgrade to Twitter Pull 7.x-1.0-rc3 [6] Also see the Twitter Pull [7] project page. -------- REPORTED BY --------------------------------------------------------- * Sylvain Delbosc [8] * Alex Pott [9] * Tom Phethean [10] -------- FIXED BY ------------------------------------------------------------ * Sylvain Delbosc [11] * Josh Caldwell [12] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [13] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. [1] http://drupal.org/project/twitter_pull [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/twitter_pull [4] http://drupal.org/project/twitter_pull [5] http://drupal.org/node/1801442 [6] http://drupal.org/node/1801444 [7] http://drupal.org/project/twitter_pull [8] http://drupal.org/user/174778 [9] http://drupal.org/user/157725 [10] http://drupal.org/user/881620 [11] http://drupal.org/user/174778 [12] http://drupal.org/user/855980 [13] http://drupal.org/user/27 [14] http://drupal.org/contact [15] http://drupal.org/security-team [16] http://drupal.org/writing-secure-code [17] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-149 - Hostip - Cross Site Scripting (XSS)
by security-news＠drupal.org 03 Oct '12

03 Oct '12

View online: http://drupal.org/node/1802218 * Advisory ID: DRUPAL-SA-CONTRIB-2012-149 * Project: Hostip [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-October-03 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Hostip enables you to query the http://www.hostip.info/ [3] API to get the country / state information based on the user's IP address or a specific IP passed to it. The module fails to sanitize data retrieved from an untrusted third party source, thereby exposing an arbitrary script injection vulnerability (XSS). This vulnerability is mitigated by the fact that an attacker must have either gained access to that third party source or use techniques such as DNS spoofing in order to inject malicious data. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Hostip 6.x-2.x versions prior to 6.x-2.2. * Hostip 7.x-2.x versions prior to 7.x-2.2. Drupal core is not affected. If you do not use the contributed Hostip [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Hostip module for Drupal 6.x, upgrade to Hostip 6.x-1.2 [5] * If you use the Hostip module for Drupal 7.x, upgrade to Hostip 7.x-1.2 [6] Also see the Hostip [7] project page. -------- REPORTED BY --------------------------------------------------------- * Klaus Purer [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Vaibhav Jain [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/hostip [2] http://drupal.org/security-team/risk-levels [3] http://www.hostip.info/ [4] http://drupal.org/project/hostip [5] http://drupal.org/node/1802046 [6] http://drupal.org/node/1802048 [7] http://drupal.org/project/hostip [8] http://drupal.org/user/262198 [9] http://drupal.org/user/1159692 [10] http://drupal.org/user/262198 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-148 - OG - Access Bypass
by security-news＠drupal.org 26 Sep '12

26 Sep '12

View online: http://drupal.org/node/1796036 * Advisory ID: DRUPAL-SA-CONTRIB-2012-148 * Project: Organic groups [1] (third-party module) * Version: 7.x * Date: 2012-September-26 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- OG (Organic groups) enables users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves. A group membership can be given immediately upon subscribing, or be pending - waiting for a group administrator to approve it. OG doesn't properly maintain pending memberships if the user is allowed to edit their own account. In addition, under certain circumstances, a user was able to post to a group which they were not a member of. There are no additional mitigating factors for these issues. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * OG (Organic groups) 7.x-1.x versions prior to 7.x-1.5. Drupal core is not affected. If you do not use the contributed Organic groups [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the OG 7.x-1.x module for Drupal 7.x, upgrade to OG (Organic groups) 7.x-1.5 [4] Also see the Organic groups [5] project page. -------- REPORTED BY --------------------------------------------------------- * Zoltán Tóth [6] * John Takousis [7] -------- FIXED BY ------------------------------------------------------------ * Amitai Burstein [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Lee Rowlands [9] * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/og [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/og [4] http://drupal.org/node/1795906 [5] http://drupal.org/project/og [6] http://drupal.org/user/2126442 [7] http://drupal.org/user/1792608 [8] http://drupal.org/user/57511 [9] http://drupal.org/user/395439 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-147 - FileField Sources - Cross Site Scripting (XSS)
by security-news＠drupal.org 19 Sep '12

19 Sep '12

View online: http://drupal.org/node/1789306 * Advisory ID: DRUPAL-SA-CONTRIB-2012-147 * Project: FileField Sources [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-September-19 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Drupal FileField module lets you upload files from your computer through a CCK field. The FileField Sources module expands on this ability by allowing you to select new or existing files through additional means. The FileField Sources module contains a persistent cross site scripting (XSS) vulnerability due to the fact that it fails to sanitize user supplied filenames before display. This vulnerability is mitigated by the fact that malicious users must have the ability to upload files on a field that has the "Reference existing" source enabled. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * FileField Sources 6.x-1.x versions prior to 6.x-1.6. * FileField Sources 7.x-1.x versions prior to 7.x-1.6. Drupal core is not affected. If you do not use the contributed FileField Sources [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the FileField Sources module for Drupal 6.x, upgrade to FileField Sources 6.x-1.6 [4] * If you use the FileField Sources module for Drupal 7.x, upgrade to FileField Sources 7.x-1.6 [5] Also see the FileField Sources [6] project page. -------- REPORTED BY --------------------------------------------------------- * Disclosed publicly. -------- FIXED BY ------------------------------------------------------------ * Nathan Haug [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/filefield_sources [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/filefield_sources [4] http://drupal.org/node/1789300 [5] http://drupal.org/node/1789302 [6] http://drupal.org/project/filefield_sources [7] http://drupal.org/user/35821 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/102818 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-146 - Simplenews Scheduler - Arbitrary code execution
by security-news＠drupal.org 19 Sep '12

19 Sep '12

View online: http://drupal.org/node/1789284 * Advisory ID: DRUPAL-SA-CONTRIB-2012-146 * Project: Simplenews Scheduler [1] (third-party module) * Version: 6.x * Date: 2012-September-19 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- The Simplenews Scheduler module provides a system for creating automatic email newsletters. These can be set to be sent at a fixed interval, or PHP code can be entered to evaluate a condition for a new newsletter issue to be sent. The module allows a user with the 'send scheduled newsletters' access to the scheduling form where PHP code may be entered. This code is then executed the next time the site runs cron. A site administrator granting permissions is not given sufficient warning that they are granting this level of access to the site. This vulnerability is mitigated by the fact that an attacker must have already been granted a role with the permission 'send scheduled newsletters'. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Simplenews Scheduler 6.x-2.x versions prior to 6.x-2.3. Drupal core is not affected. If you do not use the contributed Simplenews Scheduler [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Simplenews Scheduler module for Drupal 6.x, upgrade to Simplenews Scheduler 6.x-2.4 [4] Also see the Simplenews Scheduler [5] project page. -------- REPORTED BY --------------------------------------------------------- * Sascha Grossenbacher [6] * Joachim Noreiko [7] the module maintainer -------- FIXED BY ------------------------------------------------------------ * Joachim Noreiko [8] the module maintainer * Sascha Grossenbacher [9] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/simplenews_scheduler [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/simplenews_scheduler [4] http://drupal.org/node/1789274 [5] http://drupal.org/project/simplenews_scheduler [6] http://drupal.org/user/214652 [7] http://drupal.org/user/107701 [8] http://drupal.org/user/107701 [9] http://drupal.org/user/214652 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-145 - Imagemenu - Cross Site Scripting (XSS)
by security-news＠drupal.org 19 Sep '12

19 Sep '12

View online: http://drupal.org/node/1789260 * Advisory ID: DRUPAL-SA-CONTRIB-2012-145 * Project: Imagemenu [1] (third-party module) * Version: 6.x * Date: 2012-September-19 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Imagemenu module allows you to create Drupal menus from images files. The module doesn't sufficiently escape image file names when rendering menus, allowing a potential XSS attack. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer imagemenu". CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Imagemenu 6.x-1.x versions prior to 6.x-1.4. Drupal core is not affected. If you do not use the contributed Imagemenu [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Imagemenu module for Drupal 6.x, upgrade to Imagemenu 6.x-1.4 [4] Also see the Imagemenu [5] project page. -------- REPORTED BY --------------------------------------------------------- * David Houlder [6] -------- FIXED BY ------------------------------------------------------------ * Paul Maddern [7], module maintainer * Marcus Clements [8], module maintainer * Ben Jeavons [9] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [10], Ben Jeavons [11], and Greg Knaddison [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] http://drupal.org/project/imagemenu [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/imagemenu [4] http://drupal.org/node/1788726 [5] http://drupal.org/project/imagemenu [6] http://drupal.org/user/588210 [7] http://drupal.org/user/25159 [8] http://drupal.org/user/190002 [9] http://drupal.org/user/91990 [10] http://drupal.org/user/102818 [11] http://drupal.org/user/91990 [12] http://drupal.org/user/36762 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-144 Fonecta verify - Cross Site Scripting (XSS)
by security-news＠drupal.org 19 Sep '12

19 Sep '12

View online: http://drupal.org/node/1789258 * Advisory ID: DRUPAL-SA-CONTRIB-2012-144 * Project: Fonecta verify [1] (third-party module) * Version: 7.x * Date: 2012-September-19 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Fonecta verify provides an interface to retrieve information from the Finnish Fonecta company information database. The module contains an arbitrary script injection vulnerability (XSS) due to the fact that it fails to sanitize data retrieved from an untrusted third party source. This vulnerability is mitigated by the fact that an attacker must have either gained access to that third party source or use techniques such as DNS spoofing in order to inject malicious data. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Fonecta verify 7.x-1.x versions prior to 7.x-1.6. Drupal core is not affected. If you do not use the contributed Fonecta verify [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Fonecta verify module for Drupal 7.x, upgrade to Fonecta verify 7.x-1.6 [4] Also see the Fonecta verify [5] project page. -------- REPORTED BY --------------------------------------------------------- * Antti Alamäki [6] the module maintainer -------- FIXED BY ------------------------------------------------------------ * Antti Alamäki [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/fonecta_verify [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/fonecta_verify [4] http://drupal.org/node/1778782 [5] http://drupal.org/project/fonecta_verify [6] http://drupal.org/user/155131 [7] http://drupal.org/user/155131 [8] http://drupal.org/user/262198 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0